Trust & Safety Overview

Signals v1 is designed to be transparent and mechanically specified, but it is not fully trustless. The system is built to make its assumptions visible on-chain and to bound failure modes rather than hide them.

Status (as of February 6, 2026): Signals v1 is under audit and no public audit reports are available yet. LP access is private. Do your own research (DYOR) before using the protocol.

The right mental model is "deterministic mechanism under explicit assumptions." The protocol makes the assumptions legible: what is fixed by mechanics and what depends on external truth, keys, and chain liveness.

The distinction is simple:

• If a property is part of the mechanism surface, it should be derivable from on-chain state transitions inside a fixed regime.
• If a property depends on oracle truth, governance intent, or chain liveness, it is outside the mechanism surface even if it is visible as a transaction.

What the protocol guarantees

Finality is explicit. Once a settlement tick is finalized, it does not change. Claims are deterministic given the finalized tick and the position range.

Finality is expressed as an on-chain state transition. There is no "soft final" state that depends on off-chain interpretation. A market day is either finalized or not finalized. Claims are either open or not open.

Finality is also time-gated. The lifecycle defines when trading closes, when oracle submissions are admissible, when finality can be written, and when claims can execute. These gates are enforced by reverts, so phase boundaries are part of the mechanism surface rather than an off-chain convention.

Payout semantics are fixed. Range positions use a half-open interval $[\text{lowerTick}, \text{upperTick})$. Given a settlement tick, the payout rule is objective: the position pays its quantity if the tick lands inside the interval and pays zero otherwise.

The half-open convention fixes boundary behavior. Adjacent ranges do not overlap at their boundary tick, which prevents double counting at settlement.

Payouts are escrow-based. At finality, the protocol reserves a payout reserve used by claims. Claims are deterministic transfers out of that reserve after the claim delay gate opens. This keeps claim semantics inside the mechanism boundary rather than relying on future counterparty behavior.

Pricing state is public. The shared curve is on-chain. Given the state before and after a trade, the fee-free base cost is defined by the cost function difference.

This is the definition of "pricing is on-chain" in Signals: prices come from state, not from an off-chain matching engine. Any observer reading the same state and applying the same cost function is describing the same base pricing surface.

Trading cost is state-defined. CLMSR pricing defines a cost function $C(q)$. Fee-free trade cashflow is $C(q_{\text{after}}) - C(q_{\text{before}})$. Fees are applied afterward as an explicit overlay. This separation keeps the meaning of price impact and the meaning of fees distinct.

This separation is also what makes execution analysis coherent. Slippage is the state-dependent cost of moving the curve. Fees are a policy-dependent overlay. Both are real costs, but they are different layers.

Because trade execution is a state transition, the on-chain record is a complete enough object for reconstruction. Events record the trade direction, base amount, and fee overlay, and the market state defines the curve-level meaning. This does not remove the need for interpretation, but it fixes the objects that are being interpreted.

Daily accounting is consistent. A market day is a single unit of settlement and accounting, which makes outcomes deterministic and repeatable.

The day boundary is not a reporting convention. It is an on-chain accounting checkpoint. Maker-side attribution and fee allocation are realized at that boundary, and the state transition is recorded as part of protocol history.

These guarantees are mechanical. They do not depend on a website or a private API. They are properties of the on-chain state transitions.

Observable state

Signals is designed so that the mechanism can be studied through public objects:

• deployed bytecode and published source for the current regime
• proxy addresses that anchor storage and event origin
• configuration state that defines timing and admissibility rules
• market state that records the grid, the curve parameters, and the finalized tick
• events that label the history of trades, settlement, claims, and accounting

This does not remove the need for interpretation. It fixes the inputs that are being interpreted. A dashboard is a computation over these public inputs, not a separate layer of truth.

What the protocol assumes

Oracle data is honest and timely. The oracle is signed and signature-checked, but it still depends on external data sources.

The protocol can check that a sample was signed by an authorized key and that it is within timing and distance constraints. It cannot prove that the underlying data source is correct. Oracle truth lives outside the chain.

The signed-pull model separates signer from submitter. The protocol checks the signature and timing rules. It does not require any particular relayer to be online to carry the signed data on-chain.

This is a narrow trust assumption. The chain can prove which signed payload was used and that it satisfied admissibility rules. The chain cannot prove that the payload described reality. Settlement is deterministic given a payload; payload truth remains external.

Governance keys are secure. Governance authorizes routine operations and upgrades. This is a trust assumption in v1.

Governance is the authority surface in v1. It can change policy and it can change bytecode. The protocol makes this assumption explicit by keeping upgrades and configuration changes on-chain and attributable.

The operator role exists under this authority surface. Operators execute time-gated lifecycle transitions such as market creation, seeding, and finalization. Trading remains permissionless, but the write of final settlement meaning is attributable to an allowlisted role in v1. That boundary is part of the trust model by design.

Chain liveness exists. Settlement and claims require the chain to process transactions. If the chain halts, finality and claims halt as well.

Liveness is not a contract-level property. It is an environment property. The protocol does not attempt to settle off-chain when the chain is unavailable.

These assumptions are not hidden. They are the price of using external data, governance, and a live chain.

Consequences of the assumptions

Oracle truth and governance intent cannot be proven on-chain. Chain liveness is also outside the protocol's control. These constraints define the boundaries of v1: settlement and pricing are mechanically specified, while oracle inputs and governance authority remain explicit trust surfaces.

In practice, the assumptions produce concrete protocol behavior:

• If oracle data is missing or invalid, markets do not "guess." Finality is delayed and claims remain closed until a valid settlement tick is finalized.
• If governance changes timing configuration or upgrades implementations, the changes are on-chain regime boundaries. Execution behavior can shift even when the high-level mechanism description is unchanged.
• Fee policy is a per-market overlay chosen at market creation. Different markets can reference different policies while sharing the same base pricing rule.
• If the chain is congested or halts, finality and claims are delayed. The protocol waits for the chain rather than completing settlement off-chain.

The safety model is therefore not "trustless." It is a deterministic mechanism with explicit dependencies: the curve defines prices, the oracle defines the daily observation, governance defines the v1 authority surface, and the chain defines the execution environment.

The trust model can therefore be summarized as a set of boundaries:

• The protocol enforces deterministic pricing, finality, and claims.
• The protocol relies on external truth for oracle inputs.
• The protocol relies on an authority surface for upgrades and certain lifecycle steps in v1.
• The protocol relies on chain liveness for settlement and claims to complete.

Clarifications

• “Transparent” does not mean “trustless.” It means assumptions are visible.
• Finality is not instant. It is explicit and time-gated.
• Slippage is not a fee. It is a property of the shared curve.
• Audits reduce uncertainty, not risk. Scope and findings still constrain conclusions.

Related sections:

• Governance and Trust Model
• Failure Modes and Fallbacks
• Threat Model
• Invariant Summary
• Known Limitations
• Audits