The market price helps decide whether a proposal is accepted. The market also resolves in the condition where that proposal is accepted. This creates endogenous resolution: the forecast influences whether the forecast pays out.

Favorable information makes the proposal look better. It also makes the proposal more likely to be accepted. Unfavorable information makes the proposal look worse. It also makes the proposal more likely to be rejected.

This creates asymmetric exposure in the accept condition. Traders are more exposed to worlds where favorable information appears, because those are the worlds where the proposal is more likely to be accepted and the accept condition is more likely to resolve.

This is the core mechanism behind decision selection bias.

A natural mitigation is to look for a market fingerprint of this bias. If a TWAP was inflated by decision selection bias, then the inflated part should decay once the relevant favorable information fails to appear. A protocol could wait after the decision window, watch for that decay, and reset the measurement if the decay appears.

That approach runs into a detection problem.

Strategic decision selection bias can determine which histories reach acceptance without creating an observable price movement in the histories that do reach acceptance. A proposer with private information can allow favorable states to pass and block unfavorable states. The accepted path can look stable, even though the acceptance event is selected.

This makes the bias hard to detect from the realized market path.

Market Bias

Suppose a proposal has a proposal acceptance threshold: the minimum forecasted impact required for the proposal to be accepted. From here on, call this the acceptance threshold.

In many futarchy designs, the relevant decision statistic is a conditional delta:

conditional_delta = forecast_if_accepted - forecast_if_rejected

The proposal is accepted if the conditional delta is high enough.

Now suppose the market pays only if the proposal is accepted. If the proposal is rejected, the market is refunded or does not resolve. Conditional markets work this way: they pay in the condition where the relevant decision is taken.

This changes what traders care about.

Positive information increases the expected value of the accepted proposal. It also increases the probability that the accept condition resolves.

Negative information decreases the expected value of the accepted proposal. It also decreases the probability that the accept condition resolves.

So the accept-side price can overweight favorable-information worlds. Those are the worlds where the proposal is more likely to be accepted and where accept-side traders are more likely to be paid.

For example, suppose a proposal is valuable only if a private audit finds that it fixes a real bug.

If the audit is favorable, the proposal is likely to be accepted and the accept condition resolves on a valuable proposal.

If the audit is unfavorable, the proposal is likely to be rejected and the accept condition does not resolve.

Before the audit is revealed, the accept-side price can be biased upward. The market is effectively putting more weight on the good-audit worlds, because those worlds are more likely to produce acceptance and settlement.

The bias comes from resolution filtering. Negative information often prevents the accept condition from resolving, while positive information makes resolution more likely.

TWAP Timing

A TWAP is a time-weighted average price.

It prevents one momentary price from deciding the outcome. It also preserves old prices inside the decision rule.

That matters when the market can learn proposal-relevant information during the TWAP period.

Before information is revealed, the market is in the pre-reveal state. After it is revealed and priced in, the market is in the post-reveal state.

Pre-reveal prices can contain a selection premium. Traders know that favorable information may appear later, improve the proposal, and increase the chance of acceptance. That possibility can lift the accept-side price before the information arrives.

Post-reveal prices price the revealed information directly. If the reveal resolves the relevant uncertainty, then the specific pre-reveal DSB channel has expired. The price may still be high because the information was favorable, but the price is then responding to known information.

A normal TWAP can mix these regimes.

It may contain early pre-reveal samples inflated by decision selection bias and later samples based on revealed information. The final decision can depend partly on current information and partly on old samples that were high because favorable information was expected to increase the chance of acceptance.

That is the TWAP contamination problem.

DSB Decay

DSB decay happens when the upward selection premium in the pre-reveal price loses value over time.

Early in the TWAP, traders may believe that favorable information could appear and make the proposal accepted. That possibility can inflate the accept-side price because favorable information both improves the proposal and increases the chance that the accept condition resolves.

This premium has force while favorable information can still affect the current decision.

If favorable information fails to appear by the time it must appear to affect the current decision, traders should price non-revelation. The missing reveal no longer supports the correlation between favorable information and current acceptance.

Once that possibility expires, the pre-reveal selection premium should decay.

If the proposal only looked good because of that premium, the live conditional delta should fall.

This creates a tempting detection heuristic:

if the candidate TWAP was DSB-inflated, then the live conditional delta should decay once favorable information fails to arrive

The protocol could try to detect this decay and reset the measurement window before the biased TWAP finalizes.

Why The Decay Fingerprint Is Hard To Use

The decay signal becomes strong only when traders believe favorable information can no longer help the current proposal pass.

Before that point, non-revelation is weak evidence. The proposer may simply be waiting.

So traders can rationally continue pricing the possibility of favorable information until the relevant deadline is near. The expected decay gets pushed toward the end of the market.

That makes the fingerprint difficult to use.

The protocol wants a long interval in which the market can price non-revelation. Strategic timing can compress the useful decay interval into the final moments before settlement. At that point, decay is hard to distinguish from noise, transient liquidity, ordinary volatility, or short-lived manipulation.

To make DSB decay usable, the protocol needs an enforceable information-relevance deadline that occurs well before resolution.

Traders would then know:

any favorable information that can help this candidate pass should already have appeared

Only then does non-revelation become strong evidence over a meaningful measurement period.

The difficulty is enforcing that deadline.

A TWAP deadline only says:

prices after this point do not enter the old average

The mechanism needs a stronger property:

information learned or acted on after this point cannot help the current candidate finalize

That property is hard to enforce because strategic information can affect the decision counterfactually.

Reset And Staleness Detectors

A reset window tries to turn DSB decay into a decision rule.

At the end of the decision window, compute:

decision_delta_twap = average conditional_delta during the decision window

The proposal becomes a candidate acceptance if:

decision_delta_twap >= acceptance_threshold

Then the protocol waits through a post-decision window and watches the live market.

The simplest version resets if the live conditional delta moves against the candidate. For example, if the proposal’s decision-window TWAP was above the acceptance threshold, but the live conditional delta later falls below that threshold for long enough, the candidate TWAP resets.

This detects visible adverse decay. If the candidate TWAP was high because traders expected favorable information, and that information fails to arrive in time, the live market should fall. The reset rule can then prevent old inflated samples from finalizing.

A stronger version watches movement in either direction.

Let:

live_conditional_delta = current conditional_delta during the post-decision window

Define:

staleness_magnitude = abs(live_conditional_delta - decision_delta_twap)

Then reset if:

staleness_magnitude > staleness_threshold

This catches some cases the negative-only rule misses. A large upward movement can mean favorable information arrived after the candidate TWAP was formed. In that case, the proposal should build a new measurement window with the information already priced in.

Both versions rely on an observed market movement.

The negative-only detector looks for downward decay.

The symmetric detector looks for a large movement in either direction.

This is where the detection problem appears. Strategic information can matter without producing a visible upward movement in the accepted path.

If the proposal is already on track to pass, and the proposer privately learns favorable information, the proposer can leave the market unchanged. The candidate TWAP is already high enough. The favorable state passes without a reveal, without an upward price movement, and without a staleness event.

If the proposer privately learns unfavorable information, they can sell, reveal, challenge, or otherwise cause rejection.

The strategy is:

if private_signal is good:  
    do nothing  
    let the already-high TWAP finalize  

if private_signal is bad:  
    intervene  
    prevent acceptance  

The accepted path can look stable:

price high

conditional delta stable

proposal finalized

The reset detector sees no adverse decay. The staleness detector sees no large movement. Yet acceptance is still selected by the private signal.

The favorable branch passes because the proposer stays silent. The unfavorable branch fails because the proposer intervenes.

The realized accepted history contains no necessary marker of the selection.

The Counterfactual Information Problem

The protocol observes the realized market path. It does not observe the paths that would have occurred under different private information.

Consider two worlds with the same observed accepted history.

World A:  
There was no relevant hidden proposer information.  
The price stayed high because the proposal was expected to be good.  
The proposal finalized.  

World B:  
The proposer privately learned favorable information.  
Because the information was favorable, the proposer stayed silent and allowed the already-high price to pass.  
Had the information been unfavorable, the proposer would have intervened and blocked the proposal.  
The proposal finalized.  

Both worlds can produce the same visible history:

price stayed high  
conditional delta stayed stable  
proposal finalized  

Any deterministic rule based on that history must treat both cases the same.

World B contains the selection problem. The proposal reaches acceptance only in the favorable private-signal branch. The unfavorable branch gets filtered out before finalization.

The information changes the decision counterfactually:

good signal -> no intervention -> proposal passes  

bad signal -> intervention -> proposal fails  

It determines which histories reach acceptance, while leaving no necessary positive trace in the histories that do reach acceptance.

This is the central detection barrier.

The detector is looking for realized decay, realized price movement, or realized staleness. Strategic selection can operate through unrealized branches.

If you found this interesting, have feedback or are working on something related, let’s meet: email: me@distbit.xyz, twitter (@distbit0), or schedule a 20 min call

Asset futarchy is attractive because it lets markets compare a proposal’s expected effect on token value. That comparison is only reliable when conditional prices track the proposal’s causal effect rather than strategic behavior around the decision rule.

The attacks below describe ways a proposer can make PASS-ASSET trade above FAIL-ASSET without creating commensurate value for ASSET holders. They are defensive mechanism-design examples: each one identifies a coupling failure between the conditional market price and the proposal’s true expected effect.

The mitigations also imply a current limitation: robust asset futarchy cannot be fully permissionless and autonomous. Manual gating requires reviewers, and some penalties require them to judge whether proposal terms were abusive. That review layer becomes a trusted governance surface: reviewers can allow their own malicious proposals to pass while blocking counter-proposals. The defenses below therefore replace some market attacks with a centralisation assumption rather than removing governance risk.

Asset futarchy here means a governance system where a proposal passes if conditional markets predict ASSET will be worth more if the proposal passes than if it fails. PASS-ASSET is ASSET in the world where the proposal passes. FAIL-ASSET is ASSET in the world where it fails. The important feature here is that relative conditional prices decide execution. +EV means a proposal increases expected ASSET value, and -EV means it decreases expected ASSET value. The examples below assume a 2% passage hurdle: PASS-ASSET must trade at least 2% above FAIL-ASSET for the proposal to pass.

Resistance-Contingent Delivery

A proposer promises value-creating work, but treats delivery as the backup plan. Their first choice is to pass the proposal by defending the PASS/FAIL spread, collect the proposal payout, and skip the work.

Example: a proposer asks the DAO to pay $300k for a wallet distribution partnership. The partnership is +EV to the DAO if they actually secure the wallet partner and complete the integration work, but delivery costs the proposer $180k. Instead of doing the work by default, the proposer runs a buy wall that keeps PASS-ASSET at 1.02 while FAIL-ASSET trades at 1.00. Under non-delivery, the manipulation cost is the gap between the defended price and fair PASS-ASSET under non-delivery, not the premium over FAIL-ASSET. If non-delivery makes fair PASS-ASSET 0.99, defending 1.02 costs $0.03 per PASS-ASSET bought.

If bearish traders sell 4m PASS-ASSET into the wall, manipulation costs 4m * $0.03 = $120k. Because the $300k payout is the same under delivery and non-delivery, the proposer compares the $120k manipulation cost with the $180k delivery cost. Manipulation is cheaper, so the proposer absorbs the flow, the proposal passes, and the proposer can skip the work but gets paid anyway. If bearish traders sell 10m PASS-ASSET, non-delivery manipulation would cost 10m * $0.03 = $300k, which is above the $180k delivery cost. The proposer delivers instead. Delivery makes the defended PASS-ASSET price justified, so the earlier buy-wall purchases are no longer a separate manipulation loss. The proposer pays the lower of manipulation cost or delivery cost, not both.

If the proposal fails before passage, the proposer owes no delivery and realizes no pass-conditional manipulation loss. Their downside is the proposal creation/submission cost. Ignoring capital costs, the attacker has a privately dominant strategy because weak resistance gives upside, while strong resistance lets them fall back to the honest path without a separate manipulation loss.

The proposer has converted delivery from a default obligation into a resistance-triggered backstop. Weak opposition lets them pass and get paid without doing the work. Strong opposition forces them to choose the cheaper path: keep manipulating if manipulation costs less than delivery, or deliver if delivery is cheaper. This gives the proposer a private cost cap: preserve passage by paying the lower of manipulation cost or delivery cost. If the proposer has enough capital to defend the spread, this reduces how often they need to deliver without reducing passage.

This can be used by any proposal that is +EV if delivered honestly. The harm is that futarchy approves the proposal as if delivery were unconditional, while the proposer treats delivery as optional. When countertrading is weak, the org pays for work that is not done, hence effectively using futarchy to steal resources from the org. When countertrading is strong, delivery happens only because manipulation became more expensive than work.

Legal enforcement only helps against a broken unconditional promise. It does not close this attack when the proposal itself gives the proposer delivery discretion or makes delivery resistance-contingent. Then the proposer can follow the written terms without lying or breaching a contract; the mechanism has to reject the option value upfront rather than rely on enforcement after passage.

Bag-Holder Extraction

A proposer buys enough PASS-ASSET to push the proposal above the passing threshold. The key fact is that selling PASS-ASSET is not just “voting against the proposal.” For an ASSET holder, it is a conditional exit from ASSET in the world where the proposal passes.

Example: a proposer requests a $1m treasury payment to their own consulting company for routine ecosystem strategy work that the DAO does not need. The proposal is -EV because it transfers value out of the treasury without creating offsetting value for ASSET holders. Suppose skeptics estimate that the payment and runway damage make fair PASS-ASSET 0.98 while FAIL-ASSET trades at 1.00. The 2% passage hurdle requires the proposer to defend PASS-ASSET at 1.02, so the manipulation premium is $0.04 per PASS-ASSET bought. The proposer’s private benefit is the $1m transfer, so manipulation costs exceed that benefit only after $1m / $0.04 = 25m PASS-ASSET of corrective sell flow. If traders supply only 10m PASS-ASSET, defense costs 10m * $0.04 = $400k, which is below the $1m private benefit. If the proposal fails, the proposer receives no payout and realizes no pass-conditional manipulation loss. Their downside is only the proposal creation/submission cost.

Holders are not choosing between “proposal passes” and “proposal fails” in the abstract. They are choosing between holding ASSET after passage and conditionally exiting into USD. A holder can believe the proposal is slightly -EV while still preferring pass-branch ASSET exposure to USD.

The attacker therefore does not need to buy through every holder who thinks the proposal is harmful. They only need to buy through enough corrective flow to make defense cost exceed the proposer’s private benefit. In holder-only markets, that flow is limited by holders’ heterogeneous pass-branch reserve prices. Many holders would sell their ASSET exposure only at a material premium to spot, so mild harm can leave too little conditional sell flow below the pass threshold.

For direct transfer proposals, the corrective flow required to block passage can still be very large. The proposer internalizes the transfer, while the loss is spread across holders, so the attacker’s private upside can exceed the counter-flow available below the pass threshold.

Synthetic conditional markets with shorting reduce this mechanical holder-supply constraint, because non-holders can create PASS-ASSET sell flow. But they do not make corrective flow unlimited. A large PASS short loses in the states where the seller is wrong about proposal value: the confidential counterparty is valuable, the proposer has hidden ability to deliver, or the short adds enough resistance that delivery becomes cheaper than continued manipulation and makes PASS fair. Larger size increases exposure to those adverse-selection states, so the bottleneck shifts from holder reserve prices to risk-bearing capital willing to take that exposure.

This is mainly useful for mildly -EV proposals. If the proposal is strongly -EV, more traders prefer to sell or short PASS-ASSET. If it is only slightly -EV, bullish holders may tolerate the harm and arbitrageurs may avoid large adverse-selection-bearing positions, leaving too little corrective supply below the pass threshold.

Proposal Convexity Maximisation

Decision selection bias arises because the market price decides whether the proposal executes. Asset futarchy wants a causal signal: would executing this proposal make ASSET worth more? But the market measures a correlation: in worlds where this proposal passes, is ASSET worth more than in worlds where it fails?

A proposer can exploit the gap between those two questions by timing the proposal around unresolved information about the proposal itself.

Example: a proposer asks the DAO to spend $600k on a growth campaign before the key campaign detail is known: whether it includes a major exchange co-marketing slot. If the slot is included, the campaign is worth $1.2m to ASSET holders. If it is not included, it is worth $100k. Suppose the slot has a 20% chance before the detail is known. The true ex ante EV is (20% * $1.2m) + (80% * $100k) - $600k = -$280k, so the proposal is -EV before selection.

If $300k of proposal value maps to 1% of ASSET price in this market, unconditional approval would map to PASS-ASSET at 0.9907 while FAIL-ASSET trades at 1.00, so the proposal would not clear the hurdle before selection. But the PASS market is not pricing unconditional approval. It is pricing ASSET conditional on passage, and pass worlds are disproportionately worlds where the slot exists. In the slot branch, EV is $1.2m - $600k = +$600k, which maps to PASS-ASSET at 1.02. The proposal can clear the 2% hurdle without proposer manipulation because the pass rule selects for favorable proposal-specific information rather than evaluating the ex ante mixture directly.

That conditional-branch calculation is deliberately simplified. It overstates the clean selection effect, because the same decision selection bias that helps the proposal pass also lets some unfavorable states pass. This makes the effect self-limiting, but not self-cancelling: if the dilution fully removed the selection effect, it would remove the mechanism causing the dilution. The selected pass-branch price can remain high enough to clear the hurdle even though unconditional approval would be negative-EV. If the proposal fails, the proposer receives no proposal benefit and realizes no pass-conditional manipulation loss. Their downside is the proposal creation/submission cost.

The problem is not that traders are irrational. They are correctly pricing the conditional branch they are in. The problem is that the decision market needed evidence about the proposal’s causal effect before selection, but passage selects for the favorable version of the proposal.¹

This applies to both +EV and -EV proposals. For +EV proposals, it creates an incentive to add artificial uncertainty that resolves during the TWAP window, because unresolved upside can raise PASS-ASSET before the information is revealed. For -EV proposals, the same structure can make a bad proposal pass by selecting for the subset of worlds where favorable proposal-specific information arrives.

Counter-manipulation Deterrence

A proposer submits an underspecified proposal, then buys PASS-ASSET.

The proposal has vague/missing value-relevant details: counterparties, scope, rationale, implementation plan or track record demonstration.

Vagueness reduces participation. As with bad oracle resolution rules, ambiguity makes traders less willing to trade and can reduce liquidity. The proposer then bids up PASS-ASSET while skeptics hesitate to sell, not because they approve of the proposal, but because the missing details create adverse selection.

The adverse selection matters because +EV proposers can rationally use vagueness too. A proposer with a good proposal may intentionally hide strong details, buy PASS-ASSET while skeptics underprice the proposal, then reveal those details later. That maximizes their decision-market trading returns. A -EV proposer can imitate the same pattern, making missing details look less damning and reducing the amount of capital willing to countertrade them.

Example: a proposer asks the DAO to approve a $750k exchange liquidity and market-maker package. They say the counterparty, venues, fee terms, and performance commitments are confidential until approval. In reality, the package is clearly -EV: it buys only $150k of real value, so it destroys $750k - $150k = $600k of value. The proposer buys PASS-ASSET to defend the 2% hurdle at 1.02 while FAIL-ASSET trades at 1.00.

A skeptic considering whether to countertrade faces adverse selection from the missing details. If the package is the bad hidden version, the skeptic maps the $600k loss to fair PASS-ASSET at 0.994, so selling 1m PASS-ASSET at 1.02 has expected profit of 1m * $0.026 = $26k. If the package is an obfuscated +EV version with genuinely valuable venue commitments, the skeptic estimates fair PASS-ASSET at 1.08, so the same trade loses 1m * $0.06 = $60k. If the skeptic assigns a 40% probability to the obfuscated +EV version, the expected trading profit is (60% * $26k) - (40% * $60k) = -$8.4k. The skeptic can believe the visible proposal is more likely bad than good and still decline to sell PASS-ASSET. If the proposal fails, the proposer receives no proposal benefit and realizes no pass-conditional manipulation loss. Their downside is just the proposal creation/submission cost.

The weakness is that vagueness is cheap to imitate. But vagueness becomes negative evidence only when vague -EV proposals dominate vague +EV proposals. That ratio depends on proposal-submission costs among other factors. +EV proposal creators can defend PASS-ASSET themselves without disclosing their proposal’s details, so vagueness need not reduce its passage probability or force worse proposal terms.

Fail-Branch Sabotage

The proposer commits to making the fail branch worse.

Example: a liquidity provider asks for a $500k renewal grant that is clearly worth only $100k to the DAO. The proposal itself is -EV. Traders price the overpriced grant and the precedent damage at fair PASS-ASSET 0.99. The liquidity provider also credibly threatens to withdraw liquidity and shut down support if the proposal fails, which knocks FAIL-ASSET from 1.00 to 0.965. With a 2% passage hurdle, the proposal needs PASS-ASSET above 0.965 * 1.02 = 0.9843. Fair PASS-ASSET at 0.99 clears the hurdle without requiring any additional PASS-market manipulation.

Given the threat, the market price is not wrong. PASS is better than FAIL because the fail branch has been poisoned. The attack is a commitment failure: the relevant counterfactual is a governance rule that credibly refuses sabotage threats, so proposers expect rejection and do not make the threat in the first place. A standard asset futarchy cannot make that global commitment, because it is incompatible with the “highest-priced conditional-branch wins” rule. Once the threat exists, it optimizes the local comparison between paying and suffering sabotage, even if a policy of never paying would be higher-EV across proposals.

If the proposal passes, the attacker receives the $400k overpayment and does not need to sabotage. If the proposal fails, the attacker carries out the sabotage, so failure is the only branch here with an off-path private cost. That private cost is not necessarily equal to the value lost by the org: withdrawing liquidity can cost the attacker less than the ASSET value it destroys.

This works for both +EV and -EV proposals where two conditions hold: the proposer has a real sabotage vector, and they do not value the reputational cost enough to avoid using it.

That makes it narrower than the other attacks. New proposers often lack the ability to harm the org credibly, and established proposers often care about future business. But crypto can make this threat stronger than it looks in normal corporate or political settings. Pseudonymous actors, cross-border entities, and unclear legal recourse can make it harder to punish the attacker socially or legally.

Where the sabotage vector exists, the cost is mostly off-path: if the threat works, the proposer rarely has to carry it out. A sufficiently credible attacker can reuse the threat across proposals. This creates a search incentive: actors who find credible ways to harm the org can convert those vectors into bargaining power and extract resources. The mechanism compensates the discovery of sabotage vectors.

Design implications

These attacks require defenses outside ordinary price discovery. Asset futarchy needs markets that can express negative information, and it needs admission rules that reject proposals whose contracts, omissions, or threats make the PASS-vs-FAIL comparison stop measuring causal value.

Resistance-contingent delivery is a contract-design problem. Proposers need enforceable delivery obligations, and proposal review should reject or penalize terms that let the proposer deliver only when opposition makes manipulation more expensive than work.

Bag-holder extraction is a market-access problem. Spot conditional markets limit corrective selling to current holders willing to exit pass-branch ASSET. Synthetic conditional markets let non-holders sell or short PASS exposure, broadening the capital that can oppose mildly negative-EV proposals.

Proposal convexity maximisation needs a randomised mechanism that sometimes separates market settlement from market-guided execution.² In a large randomly selected share of cases, the market should be cancelled and the proposal decision should follow its recommendation. In the remaining cases, the market should settle, but execution should be selected at random rather than by the market. Settled PASS states then no longer consist only of worlds where favorable proposal-specific information caused passage. Proposals that leave material information undisclosed should also be gated or penalized.

Counter-manipulation deterrence is mainly an admission and enforcement problem. Under-defined proposals should be rejected before trading, and value-relevant commitments should have an available enforcement mechanism.

Fail-branch sabotage requires refusing threats as proposal inputs. Proposals that make the fail branch worse through explicit or implicit retaliation should be manually gated, slashed, or otherwise penalized.

Permissioned review is not necessarily the only possible defense capable of addressing all of these attacks, though it is the only one I am aware of capable of doing so. A design that does so without recreating a trusted review layer would be a meaningful improvement over the mitigations described here.

If you found this interesting, have feedback or are working on something related, let’s meet: email: me@distbit.xyz, twitter (@distbit0), or schedule a 20 min call

Prediction market manipulation should generally fail, and even improve market accuracy. In futarchy, proposals are evaluated and selected based on prediction market estimates of their impact on chosen metrics. Futarchy proposal creators who benefit from their proposal’s acceptance may attempt to manipulate their proposal’s “pass market,” which is the prediction market that forecasts what the metric will be conditional on their proposal being selected. By artificially inflating this price, manipulation aims to make the proposal’s impact appear larger than it actually is, increasing the likelihood of the proposal’s selection.

However, such manipulation attempts typically fail because they create opportunities for informed traders to counter the manipulation trades and profit from the temporary mispricing. When a manipulator pushes the price away from its true value, informed traders can take the opposite position and earn returns when the price eventually corrects. The result is that prediction market manipulation often increases market accuracy by raising the reward available to those who invest resources in determining the correct price.

Budget-Bounded Manipulators and the Market Manipulation Threshold

Even when manipulators are willing to incur costs up to the value they assign to their proposal’s passage, their resources remain finite. A threshold exists beyond which manipulators will no longer expend resources to manipulate their conditional market. Once this threshold is reached, prices realign with the correct price through informed trading. As long as informed traders possess sufficient capital and confidence in their forecasts, they can counter any attempted manipulation since the manipulator’s endurance has limits. The “market manipulation threshold” represents the maximum amount of long shares the manipulator will purchase, which depends on their manipulation budget. After the manipulator reaches this threshold, the market effectively becomes free from manipulation as the manipulator’s budget is exhausted.

The Metric Manipulation Threshold and Perverse Incentives

A second critical threshold exists called the “metric manipulation threshold.” When a manipulator possesses this many shares, they find it profitable to increase the metric beyond what their original proposal would have achieved, profiting at the expense of traders who bet against their market manipulation attempt. Ownership of long shares in their markets provides them with positive payoffs when the metric increases.

Condition for Manipulation Resistance

Markets achieve manipulation resistance when the metric manipulation threshold significantly exceeds the market manipulation threshold. This gap, termed the counter-manipulation window, ensures that counter-manipulative traders feel comfortable opening short positions once the market manipulation threshold is reached. Counter-manipulation traders are both willing to trade and effective at combating manipulation only within this counter-manipulation window, provided they have sufficient capital and confidence in their evaluations. Below the market manipulation threshold, counter-manipulation traders remain willing to trade while the manipulator continues expending resources to maintain price manipulation. Above the metric manipulation threshold, counter-manipulation traders cease trading because they recognize that shorting the manipulated price will result in losses. At this point, the manipulator gains an incentive to increase the metric enough to make the manipulated prices in their markets actually correct. A mathematical model for determining market manipulation resistance is available at desmos version with visible calculations and web version with slightly optimised calculations.

The chart plots the proposer’s total profit from manipulation as a function of the number of long shares they buy in their proposal’s pass market. The blue line is the payoff from pure market manipulation: buy to move the conditional forecast enough to win the grant, but do not alter the metric. The orange line is the payoff when, after buying, the proposer also manipulates the metric itself. The green envelope is the better of those two strategies at each position size; values above zero indicate profitable manipulation. The dashed verticals mark the thresholds: the left is the market manipulation threshold (the largest position sustainable purely to sway the pass market before the manipulation budget is exhausted), and the right is the metric manipulation threshold (the position at which holding many long shares makes subsequent metric inflation privately profitable). The shaded gap between them is the counter-manipulation window, where informed traders can short safely because the manipulator has stopped buying but has not yet reached the point where metric manipulation becomes attractive.

Key Variables Determining Manipulation Risk

The most significant unknowns are project-specific variables. Two primary variables determine manipulation risk. First, the proposer’s profit from receiving the grant as a percentage of the cost they incur to create the promised impact matters substantially. Ensuring that the proposer must carry out promised actions regardless of their futarchy market position is crucial, as otherwise their manipulation incentive increases. Second, metric cost acceleration determines vulnerability. Metric cost acceleration describes how the total cost of manipulating the metric grows as the attempted manipulation magnitude increases. Higher acceleration means the total cost rises faster than proportionally with the manipulation magnitude. Doubling the metric increase requires more than double the cost because each additional unit of metric increase becomes progressively more expensive to achieve. This acceleration proves particularly important in the model because higher acceleration pushes the metric manipulation threshold upward and shrinks the adverse-selection risk faced by counter-traders. Greater cost acceleration means a manipulator can increase the metric less with a given budget.

Asset Futarchy vs. Metric (KPI) Futarchy

Asset futarchy demonstrates greater resistance to the adverse selection attack described in the Desmos model. A manipulator faces greater difficulty meaningfully increasing an asset’s price, even when their incentive grows due to acquiring a significant percentage of the supply. This resistance, termed the embedded-optimization defense, arises when many actors already hold exposure to the objective (an asset) and continuously optimize it, making sustained artificial lifts expensive. Asset prices are generally far more optimized than KPIs and encounter diminishing returns more quickly since they result from market processes with no simple linear-cost method to increase them. Before a KPI futarchy is created, no one necessarily has comparable exposure to the KPI or incentive to optimize it. This difference means KPIs carry much greater upside risk, placing counter-manipulators at higher risk when shorting proposals in a KPI futarchy.

Mitigation Strategies

• Reduce the profit a project derives from having its proposal accepted or funded by creating more competitive markets through auction-style strategies that negotiate better rates from projects and reduce their markup. Theoretically, paying projects an amount that makes them indifferent between funding and non-funding eliminates manipulation incentives by ensuring they value the outcome only as much as their next best use of capital and efforts. Although an auction will reduce the profit a project gains from funding, it will not eliminate it except under perfect competition. This reduction also occurs naturally when decisions lack material benefit or impact for concentrated actors or special interests, such as roadmap decisions where few people have vested interests. Projects should follow through on commitments verifiably through reputational, legal, or financial penalties.

• Select metrics with higher metric cost acceleration, meaning metrics where the total cost of manipulation grows more rapidly with manipulation magnitude, which occurs when metrics are subject to faster diminishing returns. Market-based metrics such as equity or governance token price resist manipulation more effectively because they exhibit this characteristic.

• Elicit relevant parameter values by surveying projects, then input these values into the aforementioned models to determine manipulation resistance and ensure an adequate counter-manipulation window. While traders cannot easily verify proposer preferences and costs, plausible safety margins become apparent when data from multiple projects paints a consistent picture combined with market parameters.

• Decrease the upside by increasing the starting price when price is bounded, which raises the metric manipulation threshold and reduces the extent to which large long positions incentivize metric manipulation. Since metric manipulation payout per share depends on potential price increases, greater possible increases mean more profit per share and fewer shares needed for manipulation to break even.

• Implement advisory markets where humans make final decisions and can veto suspicious market outcomes, reducing manipulation incentives.

• Replace metrics with human judgment as the market’s objective function, similar to deep funding implementations, avoiding the need to wait for future dates to resolve markets. This approach allows immediate human consultation when manipulation is suspected, settling matters quickly and nullifying manipulation attempts. This is only useful where human adjudication is scarce relative to the number of proposals requiring evaluation, accurate enough to substitute for future metric values, and where eliciting information from traders costs less than the cost of human adjudication, necessitating bot or AI agent traders.

• Allow humans to revert markets when compelling evidence of metric manipulation exists.

• Extend market timeframes if the chosen metric is potentially subject to short-term manipulation strategies such as TVL rental which are less competitive compared with long-term-oriented organic strategies.

• Run futures markets on the metric before and alongside futarchy markets, giving traders opportunities to exploit cheap metric manipulation opportunities and hardening the metric against manipulation by the time futarchy markets use it.

If you found this interesting, have feedback or are working on something related, let’s meet: email: me@distbit.xyz, twitter (@distbit0), or schedule a 20 min call

Advisory markets are prediction markets where traders forecast how different decisions will impact a chosen metric, while the decision maker retains authority over the final choice. For instance, traders might forecast whether deploying to a new blockchain will increase token price, while the DAO retains the deployment decision.

Their primary advantage over futarchy-style decision markets is that they provide useful insights into expected outcomes while allowing decision makers to evaluate market performance, and gain trust in them over time before delegating decision-making authority to market prices. Advisory markets also enable outsiders without decision-making authority to create markets that persuade decision makers by demonstrating that their proposals will likely lead to better outcomes, thereby justifying further investigation and evaluation.

These markets provide a credibly neutral signal of a proposal’s expected benefits. Market signals carry credibility because any trader can correct prices they believe to be inaccurate, creating a self-correcting mechanism that lends legitimacy to the information conveyed.

Applications of Advisory Markets

Strategic and Product Development

Advisory markets can evaluate proposals for new major products, strategies, initiatives, or decisions. They can also predict the future success of competing projects according to key performance indicators.

Protocol Operations and Configuration

Markets can assess the impact of enabling, disabling, or adjusting protocol fee switches, deploying to new chains, and integrating new protocols or assets. They can also evaluate the impact of adopting features or changes recently and successfully adopted by competing protocols or projects.

Token Economics and Fundraising

Token-related decisions include predicting token prices conditional on launch parameters and evaluating various airdrop distribution approaches. Markets can also evaluate proposed capital raises or token supply adjustments (https://www.overcomingbias.com/p/futarchy-for-fundraising).

Budget and Resource Allocation

Advisory markets can evaluate large-scale DAO capital allocation proposals. They can assess the impact of defunding contentious DAO programs that currently consume large budgets, defunding potentially parasitic or potentially misaligned entities in the ecosystem, and ending or deploying incentive campaigns. These markets can identify both opportunities and instances of waste or spending misaligned with token holder interests.

Corporate Governance

Corporate governance applications include evaluating executive or CEO equity compensation proposals. Markets can also aid in selecting suppliers or service providers (https://www.overcomingbias.com/p/futarchy-for-ad-supplier-choice).

External Market Analysis

Beyond crypto-specific contexts, advisory markets can evaluate the impact of election outcomes on national currencies or stock markets for any countries where the election outcome can materially impact national currency or stock markets.

Retrospective Evaluation Predictions

Markets can predict the results of future retrospective evaluations. For example, they might predict the result of a temp-check polling the DAO one year later on whether an initiative was overall worthwhile. Authors of large proposals can use such markets to increase their proposal’s credibility by demonstrating that the market predicts it will be evaluated positively in the future.

Criteria for When Advisory Markets Are Most Useful

Not all of these criteria are necessary, but each enhances the effectiveness of advisory markets.

Material impact on the chosen metric. Decisions must influence a substantial amount of resources or capital, or achieve impact through other means, so that effects are visible when comparing conditional market prices rather than being obscured by market noise.

Timely impact on the metric. Decisions should materially affect the metric within several months of enactment. This requirement avoids the capital-efficiency downsides of extremely long-lived metric markets. Financial asset price metrics offer a significant advantage here because they quickly incorporate the expected effects of decisions once enacted, enabling fast resolution.

Non-trivial probability for all options. Any option under consideration must have a meaningful chance of being chosen, as traders have minimal incentive to trade in conditional markets for outcomes with a negligible chance, given the market only resolves if the outcome occurs.

Manipulation-resistant metrics. Metrics must resist manipulation sufficiently that decision makers can trust the market’s reliability. Without this property, decision makers may worry that interested parties could manipulate the metric and by extension the market. Asset price metrics generally perform well on this dimension.

Contention and disagreement. A high level of disagreement among traders regarding which approach will yield the best outcome increases trading volume and by extension liquidity and market accuracy.

Clear definitions and methodology. Both the metric calculation methodology and decision definition must be unambiguous. Clarity ensures that traders can confidently participate knowing how markets will resolve, and decision makers can trust the market’s accuracy.

Subsidized liquidity from interested parties. If someone has an interest in a particular outcome being chosen, they may subsidize conditional market liquidity to improve accuracy and increase the weight decision makers place on the market’s prediction of that outcome’s effect.

Decision maker receptivity. Decision makers should be willing to further investigate or consider proposals that conditional markets identify as likely beneficial. This receptivity means that even if a proposal initially seems unlikely to be accepted, the market’s endorsement can lead to it being considered and potentially adopted, thereby giving traders a reason to identify and trade in conditional markets for promising but underappreciated proposals.

Informed participation and timely decisions. Decision makers and other informed parties should be able to trade in the market, and decisions should occur relatively soon. These conditions help avoid decision selection bias.

If you found this interesting, have feedback or are working on something related, let’s meet: email: me@distbit.xyz, twitter (@distbit0), or schedule a 20 min call

TLDR:
This article compares two forms of Futarchy, a governance mechanism using prediction markets: Asset Futarchy (predicting project token value) and KPI Futarchy (predicting a Key Performance Indicator).

• Outline: The comparison covers three main areas:
  • Efficiency: Examines capital efficiency (with and without leverage), liquidity (pre and post-decision), and how trader PnL (Profit and Loss) can be distorted by external factors or time horizons.
  • Flexibility: Discusses alignment with organizational risk tolerance, sensitivity to proposal impacts, and adaptability to diverse organizational goals.
  • Robustness: Analyzes proposal impact distortion, manipulation impact for organizations and traders, alignment with minority owner interests, and third-party dependency risks.

➜ While neither KPI nor Asset futarchy are strictly superior in terms of efficiency, KPI Futarchy generally offers greater flexibility to align with diverse objectives and requirements, while Asset Futarchy provides greater robustness, reliability and manipulation resistance.

Futarchy is a governance mechanism proposed by Robin Hanson which employs prediction markets to make decisions. Instead of voting, participants trade in markets designed to forecast the outcome of choosing one path versus another. The core idea is to harness the diverse specialised knowledge latent among market actors to predict the impact of each governance proposal.

There are two primary ways to set up these prediction markets:

1. Asset Futarchy: Creates markets predicting the value of the project’s token, conditional on a governance proposal being accepted. These predictions are usually denominated in a quote asset, like a USD stablecoin (e.g., USDC). “Quote asset” refers to the currency in which the prediction is priced.

2. KPI Futarchy: Creates markets predicting the future value of a specific KPI the organization wants to optimize, conditional on a proposal being accepted. A “KPI” is a measurable value that demonstrates how effectively a company is achieving key objectives. This requires creating “synthetic tokens” – ‘long’ and ‘short’ – representing the KPI’s value. These tokens eventually redeem for “collateral” (usually a stablecoin) based on the final KPI value at a set “resolution date” (the future date when the KPI is measured).

   Example: Imagine a KPI for ‘monthly active users’ with a target range of 0 to 300. If the actual users at resolution are 200, the ‘long’ tokens might redeem for 200/300 = 0.66 USDC each, and ‘short’ tokens for (300-200)/300 = 0.33 USDC each (assuming $1 total collateral per long/short pair).

Each proposal’s “KPI market” is made conditional on that proposal being accepted, by only resolving it if the proposal is accepted, otherwise cancelling it. The price of each proposal’s long token therefore conveys the market’s prediction of the KPI’s value at resolution, conditional on that proposal being accepted. I.e. it is the market’s prediction of the proposal’s impact on the KPI.

We can therefore decide which proposals to accept on the basis of which are expected to yield the highest KPI value (e.g. monthly active users), by accepting proposals that have the highest long token price. A similar principle holds for asset futarchy, however instead of selecting proposals according to their long token price, as we do in KPI futarchy, we select them according to their asset price, denominated in a USD stablecoin.

Asset Futarchy can be viewed as a specific type of KPI Futarchy where the KPI is essentially the project’s long-term revenue, denominated in USD, based on the assumption that revenue is the main driver of the asset’s demand.

Efficiency

➜ Futarchy efficiency, concerning capital and liquidity, shows different strengths for Asset and KPI types depending on specific conditions and mechanisms like leverage.

KPI Futarchy Can Be More Capital Efficient if a Targeted KPI is Available

➜ KPI Futarchy is more capital efficient than Asset Futarchy without leverage if the asset’s price isn’t expected to move dramatically or if a less noisy KPI is available that better isolates the proposal’s impact.

Capital efficiency refers to how much collateral traders must deposit to gain a certain amount of predictive exposure. Less collateral required means higher capital efficiency.

Why does this matter? Higher capital efficiency lowers the cost for traders to participate. More participants bring more diverse information, improving the accuracy of the market’s predictions and leading to better organizational decisions.

KPI Futarchy is more capital efficient than Asset Futarchy if one of two conditions holds:

1. Low Expected Asset Price Variation: If the asset’s price isn’t expected to move dramatically during the Futarchy market’s duration – specifically, if the total expected range (upside + downside) is less than 100% of the starting price.

   Example: If a token trades at $10 and is only expected to move between $9.50 (95%) and $10.50 (105%) during the market, Asset Futarchy is less efficient. It implicitly requires capital backing the potential price range all the way down to $0, even though the 0% to 95% range is considered irrelevant for this specific prediction. A KPI Futarchy could be designed to focus only on the 95%-105% range, requiring less collateral, by setting the lower bound of the KPI range to $9.50 and the upper bound to $10.50. I.e. in asset futarchy the lower bound is always 0, whereas in KPI futarchy it can be set to any value.

   • Conversely, if the price could swing widely, say between $7 (70%) and $18 (180%), Asset Futarchy becomes more capital efficient. It provides exposure to potential upside “for free” without needing additional collateral locked specifically for that higher range.
2. Availability of a Less Noisy KPI: If a KPI can be chosen that better isolates the proposal’s specific impact from external ‘noise’ compared to the asset price.
   • Asset prices react to many factors beyond the proposal in question: overall market sentiment, competitor actions, unrelated news, etc. This makes the asset price a ‘noisy’ indicator of the proposal’s specific effect.
   • KPI Futarchy allows selecting or constructing a KPI specifically designed to filter out most of this irrelevant noise. By reducing the KPI’s variance caused by external factors, less collateral is needed to cover potential fluctuations. The collateral mainly needs to cover the variance expected from the proposal itself.

     Example: Instead of using a KPI for “total revenue” (which behaves much like the asset price), one could use a KPI tracking only “revenue generated directly by the proposal under consideration,” thus isolating the PnL more closely to the trader’s prediction about that specific proposal.

   • The capital efficiency of KPI Futarchy also depends on the chosen upper and lower bounds for the KPI. If the KPI is heavily influenced by external factors (high noise), wider bounds are needed, which reduces capital efficiency compared to bounds covering only the proposal’s expected impact range. These bounds also determine which outcomes are captured; narrow bounds might distort the market price if the actual outcome falls outside the defined range.

Leverage Improves Capital Efficiency

➜ Introducing leverage via liquidations significantly boosts capital efficiency for both Asset and KPI Futarchy, especially for proposals with a low probability of approval.

Without leverage, if a trader would like to speculate on the impact of a proposal with a 3% chance of approval, they would receive 3c of its long and short tokens after depositing $1 in collateral, given that the value of each proposal’s tokens is a function of its approval probability. This is highly inefficient. Leverage allows meaningful participation without excessive capital lockup, ensuring potentially valuable information about unlikely-but-impactful ideas isn’t lost. Eliciting this information is key to giving fringe ideas a fair hearing. With leverage, the same trader would only need to deposit e.g. 5c (3c + 2c safety buffer) of collateral to receive 3c of long and short tokens, hence improving capital efficiency by a factor of 20.

With liquidations, capital efficiency becomes a function of volatility. Traders need sufficient collateral buffers to avoid being liquidated by temporary price swings before their prediction potentially plays out. Therefore, factors that reduce noise (like a well-chosen KPI) still improve capital efficiency by reducing the required collateral buffer.

Leverage offers a specific benefit to KPI Futarchy: it helps overcome the trade-off between the KPI range and capital efficiency. It allows setting a very high upper bound for the KPI without crippling efficiency.

• Mechanism: Leverage enables the minting of ‘long KPI’ tokens independently from ‘short KPI’ tokens. If the ‘long KPI’ token trades at 5 cents (implying a low expected outcome), a trader wanting to short it doesn’t need to provide the full $1 of collateral (95 cents of which would normally back the corresponding ‘short KPI’ token). This decoupling makes trading more efficient.
• Trader Experience: This improves the user experience for KPI Futarchy traders. Standard KPI Futarchy often must limit the potential upside (constrain the KPI range) to maintain capital efficiency. Leverage allows for higher potential returns, which is important to compensate traders for locking up capital, potentially for months, until the KPI resolves.

Asset Futarchy Simplifies Post-Decision Liquidity Through Spot Market Integration

➜ In Asset Futarchy, conditional tokens effectively become claims on the underlying spot asset post-decision, utilizing its liquidity, while KPI Futarchy requires continued liquidity subsidization.

After the decision is made but before the final outcome resolves (e.g., the KPI is measured or the long-term price impact is clear), traders might still want to trade.

In Asset Futarchy, the conditional tokens become claims on the underlying spot asset once the decision is locked in. Traders can then use the asset’s regular spot market liquidity to enter or exit positions. No separate liquidity subsidy is needed for this period (between decision and proposal impact). This makes Asset Futarchy more attractive if information continues to emerge during this time, allowing traders to adjust positions without dedicated Futarchy market liquidity.

In KPI Futarchy, there’s no underlying spot market to fall back on. To allow traders to exit their positions after the decision but before the final KPI resolution date, the market creator must ensure the availability of liquidity, e.g. through liquidity subsidies. Without this, traders’ capital remains locked until the resolution date, which degrades trader experience.

KPI Futarchy Can Increase the Predictability of Trader Returns

➜ KPI Futarchy generally ensures a trader’s PnL more accurately reflects their prediction about a proposal’s specific impact, unlike Asset Futarchy where PnL is distorted by broader market factors.

In Asset Futarchy, a trader’s PnL is only loosely tied to the proposal’s specific impact. It’s heavily distorted by all other factors influencing the asset price: general market conditions, demand changes, management decisions, other proposals, etc.

Trader Experience: This means traders are forced to take on exposure to these unrelated factors. They might correctly predict a proposal’s positive impact but still lose money if the broader market tanks before they close their position. This increases uncertainty and risk; traders prefer predictable returns linked to their specific insight.

• Hedging: Hedging these external factors is difficult and often imperfect. It typically requires dynamic rebalancing, which introduces its own costs and risks (e.g., negative gamma exposure).
• Trader Pool: While Asset Futarchy benefits from a natural pool of participants (existing asset holders already exposed to the price), this doesn’t necessarily help attract outside informed actors who aren’t already holders but might have valuable specific knowledge about the proposal.

KPI Futarchy is generally superior in this regard. The KPI can be specifically designed to reduce (though perhaps not always eliminate) distortion from external factors.

Asset Futarchy’s Infinite Horizon Distorts PnL for Time-Specific Impacts

➜ Asset Futarchy’s implicit infinite time horizon distorts PnL by incorporating long-term factors irrelevant to short-term proposal impacts, while KPI Futarchy allows for time-specific impact measurement.

Asset Futarchy implicitly operates with an infinite time horizon because asset prices reflect expectations far into the future. This means changes in long-term factors like discount rates or investor risk premiums have a greater impact on trader payouts, as these factors compound over longer periods.

Importantly, this happens even if the proposal’s impact is known to be short-term. Asset Futarchy cannot easily focus only on impacts over a specific, limited time period. Traders are affected by factors influencing the asset price far beyond the relevant timeframe for the proposal. This further distorts PnL and degrades the trader experience.

KPI Futarchy provides much greater flexibility here.

• It can be designed to measure impact only over a specific, relevant time period (e.g., the next 6 months), filtering out long-term noise.
• Conversely, it can ignore short-term noise or impacts if a decision is intended only for long-term effect, reducing volatility risk for traders focused on that horizon.

KPI Futarchy Provides Greater Flexibility

➜ Generally, KPI Futarchy offers more flexibility to adapt to different goals, sensitivities, and organizational needs.

KPI Futarchy Accounts for Risk Aversion via Payoff Modulation

➜ KPI Futarchy facilites alignment with a given level of risk aversion by modulating trader payoffs, whereas Asset Futarchy maximises expected asset value by default.

By default, Futarchy markets predict the expected outcome (a probability-weighted average). However, in many contexts decision makers are risk-averse; hence they care more about avoiding large losses than achieving proportionally large gains. Put differently, their “utility” is not a linear function of the metric which they are optimising.

Example: A proposal has a 50% chance of causing a company’s monthly active users (MAUs) to fall to 0 and a 50% chance of increasing MAUs by 200%. The expected impact on MAUs is (0.5 * -100%) + (0.5 * +200%) = +50%, a 50% expected gain over the current level of MAUs. A naive Futarchy focused only on expected value would approve this proposal.

• Organization’s View: Most organizations would find this gamble highly unappealing due to the 50% risk it entails of losing all their users.

In KPI Futarchy, this risk aversion can be directly addressed by modulating the trader payoff function. The mapping from the final KPI value to the collateral payout can be made non-linear to reflect the organization’s aversion to specific outcomes (e.g., heavily penalizing low KPI values).

In Asset Futarchy, making such an adjustment is not straightforward because the markets simply price the asset, however fortunately it is also not necesasry in the context of asset futarchy, given that companies should be trying to maximise the simple expected value of their share price anyway.

KPI Futarchy Can Offer Higher Proposal Impact Sensitivity

➜ KPI Futarchy can enhance proposal impact-sensitivity, allowing detection of smaller impacts, by focusing the KPI on the specific area affected by a decision.

Impact sensitivity refers to the smallest percentage impact on the asset price or KPI that the Futarchy market can reliably detect and price. Think of it as the futarchy’s “resolution.”

Sensitivity depends on two main factors:

1. Time until Impact: The longer the time until the proposal’s effects are measured, the lower the sensitivity (due to discounting and uncertainty).
2. Trader Capital Cost: Traders weigh the potential profit from pricing in a small impact against the opportunity cost of locking up their capital (their time preference or forgone returns elsewhere).

Example: If traders perceive their capital cost to be 10% over the market’s duration (say, 2 years), they won’t bother accurately pricing a proposal expected to have only a 3% impact. The potential gain is too small relative to the cost of participation.

Several approaches can increase sensitivity:

• Supporting leveraged positions (boosts capital efficiency, making small gains more attractive).
• Employing yield-bearing collateral assets (reduces trader opportunity costs, as proposed by Seer: Capital efficiency ).
• Prohibiting redemption of short & long tokens until the resolution date, rather than at any point over the market’s duration as is usally permitted.
• Using a non-linear KPI mapping function in KPI Futarchy that magnifies the payout differences at the low end of the KPI range, making small impacts more significant to trader returns. However this has the risk of unintentionally distorting futarchy decisions in the direction of lower risk tolerance.

Asset Futarchy is typically sensitive enough for major, top-level decisions that will clearly move the overall asset price. However, it is often insufficiently sensitive for more granular decisions whose impact on the total asset value is likely to be small or imperceptible.

KPI Futarchy can significantly improve impact sensitivity. By selecting a KPI that is more focused on the specific area affected by the decision, the proposal’s impact becomes a larger percentage change relative to that focused KPI. This increases the incentive for traders to price the impact accurately, making it potentially viable for both high-level and lower-level decisions.

However, KPI Futarchy can run into sensitivity issues if the chosen KPI is too high-level or broad compared to the magnitude of most proposals. If typical proposals only cause tiny percentage changes in the KPI, they might still fall below the sensitivity threshold. The KPI needs to be on a similar “scale” to the proposals being evaluated.

KPI Futarchy Supports Diverse Goals Beyond Asset Value Maximization

➜ While Asset Futarchy primarily aims to maximize asset value, KPI Futarchy supports a wider range of quantifiable goals, including non-financial objectives and inter-organizational agreements.

Asset Futarchy is ideal for the top-level governance of organizations whose main objective is to increase value for shareholders or token holders.

• It can be adapted somewhat, for instance, by tokenizing the projected revenue stream of each individual proposal and running Futarchy on those specific tokens. This, however, blurs the line into a hybrid KPI/Asset approach.

KPI Futarchy is also suited to contexts where the goal is something other than maximizing long-term shareholder value. This includes pursuing specific political, social, technical, or scientific objectives – goals often found in non-profits or public goods projects. As long as the goal can be quantified into a measurable KPI, Futarchy can target it.

• The KPI could even be the output of a retroactive evaluation committee, allowing Futarchy to target goals that are difficult to measure objectively.
• KPI futarchy supports composite KPIs, allowing for the combination of multiple KPIs into a single KPI, with each assigned a different weight. This allows more complex goals to be expressed, while also potentially mitigating the manipulation risk of any single KPI.
• KPI Futarchy also enables novel forms of inter-organizational cooperation. An organization governed by KPI Futarchy could incorporate another organization’s utility function into its own KPI definition as part of a negotiated agreement. This allows for binding treaties between organizations without needing external legal enforcement. See: Futarchy of mutating preferences.

Asset Futarchy Offers Superior Robustness

➜ Generally, Asset Futarchy has superior properties in robustness due to the nature of asset markets. Robustness relates to resistance against manipulation and distortion, alignment with stakeholder interests, and reliability over time.

Both Face Distortion Risks, but from Different Sources

➜ KPI Futarchy can suffer impact distortion from pre-set KPI bounds affecting capital efficiency and neutrality, while Asset Futarchy can be distorted by changes in the quote asset’s value.

Proposal impact distortion refers to systematic biases in the Futarchy market’s estimation of a proposal’s true impact.

KPI Futarchy requires the market creator to specify upper and lower KPI bounds in advance. This creates a trade-off:

• Narrower bounds improve capital efficiency (less idle collateral).
• Wider bounds reduce distortion (incentivizes traders to price in even extreme outcomes).

However, using wider bounds means locking up more collateral to cover unlikely outcomes, reducing capital efficiency. This tension means distortion and capital efficiency are often inversely related in basic KPI Futarchy. Furthermore, the need for someone to set the bounds reduces credible neutrality. A market creator could potentially set bounds strategically to disadvantage proposals they oppose (e.g., setting a low upper bound for a proposal they dislike to bias the market’s estimate downwards). Introducing leverage can mitigate this by decoupling the KPI range from capital efficiency.

Asset Futarchy avoids these specific issues. It doesn’t require an arbitrary upper price bound to be set, nor does it require collateral to be locked for extreme upside possibilities. Just as buying Bitcoin at $15k didn’t require locking up collateral in case it hit $100k, Asset Futarchy handles potential upside naturally.

However, Asset Futarchy is not immune to a different type of distortion. Its predictions rely on a quote asset (e.g., USDC). It’s theoretically possible for a proposal to appear beneficial if it’s expected to decrease the value of the quote asset rather than increase the value of the base asset. This risk is low if the quote asset is robust and largely independent of the Futarchy’s decisions. But if the Futarchy becomes powerful enough, a proposal could potentially involve an economic attack on its own quote currency. Mitigation could involve requiring proposals to be positive-EV according to markets using multiple, independent quote assets.

A similar attack vector exists for KPI Futarchy through its collateral asset. A malicious stablecoin operator could credibly commit to devaluing the stablecoin collateral if their preferred proposal fails, thus artificially inflating the market’s estimate of that proposal’s benefit.

Asset Futarchy Aligns Manipulation Cost with Value Increase; KPI Metric Manipulation is Often Cheaper

➜ Manipulating Asset Futarchy outcomes to pass a proposal requires genuinely increasing expected asset value, aligning with goals, whereas manipulating KPI metrics is often cheaper and less aligned with the Futarchy’s true objectives.

Consider manipulation of the ground truth or resolution source, not direct manipulation of the prediction market prices (which informed traders can counter).

For Asset Futarchy, the cost of manipulating the outcome to make a proposal pass (e.g., by donating to the treasury conditional on passage) is equal to the cost of actually increasing the asset’s expected value. Such “manipulation” aligns with the Futarchy’s goal; it’s essentially a bribe offered to the organization. It only succeeds if the bribe exceeds the market’s perceived cost of the proposal. This reflects strong alignment between the mechanism and the goal of asset value maximization.

For KPI Futarchy, manipulating the underlying KPI metric is often easier and less aligned with the organization’s true goals. Most KPIs are proxies, and proxies can be gamed (Goodhart’s Law). It might be possible to boost the KPI score in ways that don’t actually achieve the intended underlying objective, or even run counter to it.

This underscores the importance of selecting KPIs where the cost of manipulating the metric scales with the value of the decision, and ideally, the manipulation cost is always greater than the benefit an attacker could derive from forcing a proposal through the KPI Futarchy.

Traders Perceive Higher Metric Manipulation Risk and Lower Neutrality in KPI Futarchy

➜ Traders face adverse selection from metric manipulation, perceiving higher risk and lower credible neutrality with custom KPIs in KPI Futarchy compared to widely observed asset prices.

A bad actor who knows how to manipulate the final KPI value (or asset price, though often harder) can trade profitably against uninformed participants.

Example: Someone finds a loophole to artificially inflate a KPI. They buy ‘long KPI’ tokens cheaply, then trigger the manipulation near resolution, profiting at the expense of others. This risk is similar to trading in markets with vague resolution criteria (e.g., some past Polymarket examples) where ambiguity allows exploitation.

Consequently, traders will tend to avoid Futarchy markets where the metric’s manipulability is unclear, where they suspect the creator might exploit it, or where the manipulation cost is known to be low.

Traders generally fear KPI manipulation more than asset-price manipulation. Asset prices, being widely traded and observed, are perceived as more credibly neutral. Understanding the potential manipulation surfaces of a custom KPI requires significant extra due diligence, deterring participation. The risk of information asymmetry (insiders knowing more about manipulation potential) is higher in KPI Futarchies. There’s simply more room for debate, interpretation, and hidden manipulation vectors with bespoke KPIs.

KPI-based Futarchies thus possess lower inherent credible neutrality from a trader’s viewpoint. It’s crucial for designers to select KPIs with transparent, well-understood, and high manipulation costs, and communicate these properties clearly.

An subtle point is that if the cost for traders to decrease the ground truth value of a metric is similar to a Futarchy’s proposal’s cost / expected metric increase, then one or more of the following will be true:

• either the proposal creator will find it profitable to manipulate their own proposal’s futarchy markets
• or traders will find it profitable to manipulate the ground truth value of the metric
  This is because a futarchy market’s liquidity is ultimately limited by the manipulation cost of the metric, or else the market risks becoming a metric “manipulation bounty” in the eyes of sophisticated traders. However liquidity must also be sufficient to deter a proposal creator from trying to manipulate their own futarchy markets.

Asset Futarchy Protects Minority Owners from Expropriation

➜ Asset Futarchy inherently protects minority owners by aligning decisions with overall token value, while KPI Futarchy, focused on specific KPIs, does not offer this same protection against value expropriation.

(Recommended reading: Futarchy as Trustless Joint Ownership). In traditional DAOs or corporations, minorities are often subject to the whims of majority coalitions, exposing them to potential value extraction (expropriation). Futarchy, by ensuring decisions pass only if they are predicted to increase token value, provides a strong protection against this, with significantly lower overhead than traditional legal recourse.

Mechanism: If a majority proposes an expropriating action (harms overall value but benefits them), the predicted asset price conditional on the proposal passing will fall sharply. The price conditional on it failing will reflect the fair pre-proposal value. To force passage, the attacker must buy up the low-value ‘pass’ tokens and sell off the higher-value ‘fail’ tokens.

• Outcome: Minority holders can sell their stake to the attacker at a premium. The attacker effectively funds a risk-free exit for all existing holders while incurring prohibitive costs, making such attacks unprofitable.

In contrast, KPI Futarchy cannot provide this trustless guarantee for minority asset holders. A proposal might correctly predict an increase in the chosen KPI and therefore pass, yet still harm the underlying asset value held by minorities. They would have no recourse within the Futarchy mechanism itself.

This isn’t a flaw of KPI Futarchy, but a reflection of its different objective: maximizing a specific KPI, not necessarily preserving or maximizing shareholder value.

KPI Futarchy has more Intrinsic Third-Party Dependencies

➜ Both Futarchy designs have third-party dependencies (e.g., stablecoins), however KPI Futarchy’s reliance on a KPI oracle is more fundamental and introduces risks of failure and malicious control.

Both systems introduce dependencies:

• Asset Futarchy enshrines a quote asset (e.g., a fiat stablecoin) and depends on its continued availability and solvency.
• KPI Futarchy enshrines a KPI oracle (the data source) and depends on its durability and honesty. It also often enshrines a stablecoin as the collateral for outcome tokens.

Ultimately, Asset Futarchy’s dependency on a specific stablecoin isn’t strictly necessary. A more censorship-resistant native asset (like ETH) could be used as the quote asset, although this introduces price volatility as a confounding factor.

Therefore, only KPI Futarchy necessarily retains a dependency in the form of its KPI oracle (unless the KPI can be computed trustlessly on-chain). Furthermore, even accurately-reported KPIs are prone to degradation over long time scales due to Goodhart’s Law/metric gaming.

If either the oracle or the critical stablecoin becomes unavailable or fails, the Futarchy could become inoperable, potentially freezing all assets under its control unless a recovery mechanism is in place.

Worse, if the KPI oracle or the stablecoin issuer becomes compromised or malicious, they could potentially steal all assets governed by the Futarchy. By controlling a key input to the resolution process, they can manipulate outcomes to pass arbitrary proposals that benefit them.

Examples: A malicious stablecoin operator could commit to increasing the stablecoin’s value conditional on their proposal failing (in Asset Futarchy) or commit to making the stablecoin collateral worthless conditional on their proposal failing (in KPI Futarchy), both biasing the market towards passing their proposal.

Despite its additional dependency on a KPI oracle, KPI Futarchy isn’t necessarily unsuitable as a long-running governance mechanism. Just that if used this way, robust mechanisms are essential to recover from faulty or malicious oracles (or collateral failures), potentially requiring delegation of emergency powers to a trusted entity. Crucially, if the organization’s goal is to optimize a non-asset-price KPI, Asset Futarchy simply isn’t a substitute, despite its robustness advantages.

If you found this interesting, have feedback or are working on something related, let’s meet: email: me@distbit.xyz, twitter (@distbit0), or schedule a 20 min call

Decision markets are how prediction markets become useful for making decisions. The event probabilities which prediction markets currently elicit can sometimes be useful for informing decisions, however they are not optimised for this purpose.

Prediction markets only reveal the probability of an event, whereas decision markets reveal how different actions would impact the outcome being predicted. For example, a prediction market might reveal that p(GDP increasing year over year) = 0.4 (where p() denotes probability), whereas a decision market could tell us that conditional on electing Ron Paul, p(GDP increasing) = 0.9, whereas only 0.06 if Kamala Harris were to be elected (figures are for illustrative purposes only).

While the output of a prediction market can be useful, the conditional probabilities provided by conditional prediction markets are much more actionable. In this case, they could be used to conclude that voting for Ron Paul is the superior action, if one’s goal is a higher GDP.

All the above however is still framed in the context of politics, which despite being the domain in which prediction markets have excelled, is unlikely to be where decision markets create the most value. Politics-focused prediction markets are popular because people enjoy betting on matters which they have tribal or ideological connections to, given that the target customer base of prediction markets, such as Polymarket, is speculators. The target customer base of decision markets, however, will be information buyers; those willing to pay to discover which action the market believes they should take in order to maximise success according to a given metric.

The goal of decision markets is to elicit from market participants what the expected impact of an action is on a selected metric. While this might seem simple, given the below high level outline, there are several confounding, alignment and manipulation risks which are important to consider and potentially mitigate and which are the focus of this article.

Mechanism overview

Here’s how decision markets work in the context of a DAO evaluating funding proposals (where funding a proposal is considered an action):

For a batch of funding proposals, we create conditional tokens:

1. A “Yes” token for each proposal that pays out based on the metric if that proposal is executed
2. A single “No” token for the batch that pays out based on the metric if none of the proposals are executed

These tokens use a scalar design where the payout is proportional to the value of a composite metric. The key tokens are:

• \(\textsf{Long}^{\text{yes}}_i\): Redeems for a value proportional to the metric if proposal i is executed
• \(\textsf{Long}^{\text{no}}\): Redeems for a value proportional to the metric if no proposal in the batch is executed

The relative price of \(\textsf{Long}^{\text{no}}\) and each \(\textsf{Long}^{\text{yes}}_i\) reveal what the market expects each action’s impact to be on the selected metric (subject to caveats, analysis of which will constitute the remainder of this report). From here onwards score(action) will be used to refer to \(\frac{\textsf{Long}^{\text{yes}}_i}{\textsf{Long}^{\text{no}}}\) for a given action, where a higher score(action) indicates an action is assessed as being more favourable in terms of the metric. The value of score(action) can be used to select which actions to take, on the basis of the ratio between each action’s cost and its score, i.e. its cost:benefit ratio.

Implementation of the above requires selection of an AMM design or other mechanism for facilitating the exchange of shares and construction of the composite metric on which to evaluate actions. A decision rule also must be selected, which is an algorithm for deciding which actions to take, given the predicted impact on the metric and magnitude of each action’s respective cost.

For some further reading on decision market design, see:

• https://ggresear.ch/t/conditional-funding-markets/27
• https://github.com/zack-bitcoin/amoveo-docs/blob/3747c9c7b330a03531da0cbeb111fafac6839f81/basics/msrs_and_prediction_markets.md
• https://ethresear.ch/t/prediction-market-design-for-betting-on-many-highly-improbable-events/8280
• https://ethresear.ch/t/practical-futarchy-setup/10339
• https://timroughgarden.github.io/fob21/reports/ZLRL.pdf
• https://ethresear.ch/t/possible-futarchy-setups/1820
• https://mason.gmu.edu/~rhanson/combobet.pdf
• https://github.com/metaDAOproject/Manifesto/blob/main/Manifesto.pdf

Confounding

Decision markets can suffer from confounding because they are trying to use market-implied conditional probabilities as a proxy for measuring the impact of an action on the value of a metric. Decisions are made based on the relative prices of \(\textsf{Long}^{\text{yes}}\) and \(\textsf{Long}^{\text{no}}\) shares, in each action’s market. Any factors which speculators consider when pricing these shares, aside from their expectations of an action’s impact, are confounding variables. Confounding variables distort the price with information which is irrelevant to maximising the value of the metric, hence making the decision market prices less useful.

Confounding occurs when the variable you are measuring the impact on (the dependent variable) is affected by variables other than the variable you are actually trying to measure the impact of (the independent variable). You might want to measure the effect of A on B but end up accidentally measuring something different due to one or multiple of the below three types of confounding:

Common cause confounding

• due to the effect that C has on both A and B
• where C is what is known as a “common cause” variable, due to it influencing both A and B, making it seem as though they are causally connected

An illustration of common cause confounding is that ice cream sales are correlated with shark attacks, but one should be careful not to conclude from this that recently having ingested ice cream causes sharks to pay them special attention:

Higher consumption of ice cream  
↑  
Warmer weather <---------- confounding common cause variable  
↓              
More people swimming at the beach  
↓  
More shark attacks  

Mediation confounding

• when you end up measuring the the effect of A on D and the effect of D on B
• where D is a “mediating” variable, acting as a “bridge” between A and B

Mediation applies when a variable exists which partially or fully mediates the causal relationship between the dependent and independent variables. Mediation can confound measurements when the mediating variable is not accounted for, causing its impacts to be incorrectly attributed to the independent variable directly impacting the dependent variable. An example of this is if one concluded that propeller rotation is directly responsible for aircraft propulsion, without considering the movement of air (a mediating variable), and therefore decided to use propellers as a propulsion mechanism for spacecraft.

Rotation of propeller  
↓              
Aerodynamics resulting from presence of atmosphere  <---------- confounding mediating variable  
↓  
Propulsion of aircraft  

Reverse causality confounding

• where you measure the effect of B on A, instead of measuring the effect of A on B
• i.e. the direction of causation is opposite to what you thought it was
  • so what you think is the independent variable is actually the dependent variable and what you think is the dependent variable is actually the independent variable

An example in the context of reverse causality would be concluding that painkillers cause injuries due to consumption of painkillers and injuries being highly correlated:

Injury  
↓             <---------- confounding reverse causal pathway  
Consumption of painkillers  

Strategy: Standard futarchy setup

The most straightforward setup is to base action decisions directly on the decision market’s output and decision rule. This approach is typically what people mean when they refer to “decision markets.” It has two major advantages:

1. Decisions are informed by the information generated by the prediction markets.
2. Risk of confounding variables is mitigated

At a high level, this setup achieves these benefits by forcing all potential confounds through a single, narrow bottleneck: score(action). This represents the decision market’s expectation of the impact of taking vs not taking an action, on the value of the metric.

The above mentioned confounding mechanisms are only possible if the choice of action is influenced by a confounding variable. As a result, the relevance of score(action) to confounding is hard to overstate, as any confounding variable must go through score(action) in order to influence the choice of action, given that actions are chosen according to their respective score(action) values. score(action) is the sole thing standing between the standard futarchy setup and one where confounding is impossible, due to e.g. actions being selected at random.

Below are some causal diagrams which depict different types of confounding in the standard futarchy setup.

Ideal situation (no confounding):

expected impact of action  
      ↓                    
score(action)  
      ↓  
p(action is taken)  

Common cause:

p(action is taken)  
      ↑  
score(action)  
      ↑  
hypothetical "common cause" confounding variable  
      ↓   
expected impact of action  

Reverse causality:

p(action is taken)  
      ↓                 <-------- hypothetical confounding reverse-causal pathway  
score(action)  
      ↓                     
expected impact of action  

Mediation:

expected impact of action  
↓         ↓  
↓         hypothetical "mediating" variable  
↓         ↓  
score(action)  
↓         ↓  
p(action is taken)  

Mediation confounding

Mediation confounding can occur in this setup if a “mediating variable” exists, creating an additional causal path between expected impact of action and p(action is taken). Mediating variables become problematic when they’re not consistently present, causing the measured correlation to diverge from the real-world correlation where the mediating variable may be absent. For instance, in the propeller example, the mediating variable (atmosphere) becomes an issue when the propulsion technology is applied in the vacuum of space.

In this futarchy setup, a mediating variable exists that is present during measurement but not during execution, potentially distorting score(action). This variable is the decision rule, which selects actions based on their score(action) values. While intended to choose the most promising action, it inadvertently increases the correlation between p(action is taken) and expected impact of action by mediating an additional causal path between them (illustrated in the diagram below). Consequently, it biases score(action) upwards for all actions, as score(action) effectively measures the correlation between p(action is taken) and expected impact of action.

expected impact of action  
↓         ↓  
↓     decision rule  
↓         ↓  
score(action)  
↓         ↓  
p(action is taken)  

This tendency of the standard futarchy setup to overestimate the benefit of an action would be of minimal concern if it applied to all actions equally, as it would then at least preserve the ranking of actions according to their expected benefit. Unfortunately however, this distortion affects some markets more than others, and hence can meaningfully impact the relative attractiveness of actions, according to their decision market scores.

Impact of new information

The reason for this asymmetry is that the magnitude of the distortion expected to result from a mediating variable is proportional to its expected variance over the period of the market. If the mediating variable is not expected to change, it is consequently also not expected to increase the correlation between expected impact of action and p(action is taken), and hence will not impact score(action). As a result, the more variance expected in the value of score(action) (and hence in the output of the decision rule), for a given action, the more the decision market will optimistically bias its estimate of the action’s benefit.

greater variance in score(action)  
          ↓  
greater variance of output of decision rule  
          ↓  
greater correlation between expected impact of action and p(action is taken)  
          ↓  
higher value of score(action)  
          ↓  
action is (artificially) more likely to be selected  

In other words, the more new information expected to be revealed about an action, the more positively biased its decision market score will be. This can also be thought of as the result of shares conditional on an action being taken having a convex payoff, like options, resulting in positive gamma, and hence positive vega (volatility increases probability of reaching higher points on the convex payoff function), which signifies a positive sensitivity to changes in volatility.

Another framing of this is that if you think an action’s market-implied score is too high, you will be less inclined to correct the mispricing, by buying \(\textsf{Short}^{\text{yes}}\), if you think the market will converge to your belief prior to the market closing. This is because if the market-implied score converges (downwards) to your belief, the action is less likely to be taken, in which case your position is worth $0 due to being conditional on the action being taken. So the more you expect the market to update towards your belief, hence the higher the volatility, the less attractive your short position will seem and the more attractive a long position will seem.

Manipulation risk

This is challenging, as it makes it difficult to compare market prices for different actions, due to them potentially being distorted to different degrees by this optimism bias. An economic vulnerability also potentially arises, if malicious proposal creators exploit this to increase the decision market score of their proposal, by attempting to create an expectation that new information pertinent to it will soon be revealed.

For example, consider a proposal for developing an improved risk modeling suite for the DAO’s treasury management. The proposal creator might strategically mention that they are working on a new approach to risk assessment, the details of which will be finalized during the initial phase of the project. They might hint at preliminary tests showing promising results in predicting market volatility, without providing specific data. This creates an expectation of important new information to be revealed, potentially inflating their decision market score due to the optimism bias.

proposer hints at important announcement  
          ↓  
greater uncertainty   
          ↓  
greater variance of output of decision rule  
          ↓  
greater correlation between expected impact of action and p(action is taken)  
          ↓  
higher value of score(action)  
          ↓  
action is (artificially) more likely to be selected  

Mitigation strategies may involve any of the following:

1. Measuring the expected (or perhaps even the actual) variance of each market, then arithmetically adjusting each market’s price to control for this variable, using techniques from option pricing.
2. Equalising/limiting variance across markets by penalising or rejecting proposals from creators who claim that important information is yet to be revealed by the time their proposal’s decision market has begun.
3. Automatically extending markets if their volatility soon before resolution is above a certain threshold, so that the decision market price used for action selection is free from the optimistic bias present prior to the revelation of new information.
4. Ensuring traders are aware of the economic vulnerability, so they are attuned to and can discount markets where they perceive the creator to be trying to create artificial uncertainty around the impact of the proposal.
5. Limiting the duration of markets such that it is implausible a meaningful amount of new information will be revealed over the period of the market.

Reverse causality

Reverse causality is also only partially mitigated by this default decision market configuration. Specifically, reverse causality remains possible via the same channel through which common cause confounding is possible: score(action). If there is a causal path from expected impact of action to to action is selected, confounding due to reverse causality can occur. Analysis into what may cause reverse causality and or common cause confounding in decision markets is left for future research.

Strategy: Decision randomisation

An alternative strategy, capable of completely eliminating confounding, is to simply select which actions to take at random. The reason this works is akin to the reason patients are randomly selected to be in either the experimental or control arms of a study. It ensures no confounding differences between participants in the two arms of the study remain, so the only difference is that participants of the experimental arm received the intervention while those in control did not.

expected impact of action  
↓         ↓  
↓   random decision rule   <------- action choice now randomised, hence "deactivating" this confounding pathway  
↓         ↓  
score(action)  
↓         ↓  
p(action is taken)  

In the diagram above, randomising the decision rule causes it to no longer have a disparate impact on actions according to how high their score(action) is. As a result, it effectively removes the confounding pathway.

The problem with this approach is that it is very expensive, because it requires actions to be taken at random regardless of their expected outcome. It is ironic that for decision market prices to not be confounded, they must not be used to make decisions, as the actions must be taken at random. Fortunately it is possible to avoid almost all confounding, while still being able to use decision market prices to inform decisions.

Strategy: Randomise, sometimes

The “randomise, sometimes” strategy addresses confounding in decision markets by occasionally selecting actions at random. It works by cancelling the market 90% of the time, making all shares worth $0. In the remaining 10% of cases, an action is randomly selected and the markets are resolved based on the results of these random actions. Trader rewards are then multiplied by 10 to compensate for the 90% cancellation rate.

This approach eliminates confounding because traders price shares solely based on the random selection scenario, while the non-random 90% doesn’t affect pricing due to market cancellation. Importantly, this strategy allows decision-makers to use market predictions to inform choices 90% of the time, while still maintaining unbiased market prices. It effectively separates the price formation process from actual decision-making, preserving the market’s informational value while preventing feedback loops that could distort prices.

expected impact of action  
        ↓  
    score(action)  
        ↓  
Random selection (10% chance)  
    /           \  
   /             \  
  ↓               ↓  
Random action   Use score(action)  
  ↓               ↓  
Resolve market  Cancel market  
  ↓               
10x rewards     
  ↓  
Informs future pricing  
(No confounding pathway)  

This strategy has two notable advantages:

1. 90% (or some other high proportion) of the time, you can take the action which the decision markets predict will most positively impact the metric. We cancel the market in these cases to prevent the non-random action selection process from contaminating the price.
2. No confounding is possible, because traders price the decision market shares only according to the scenario where the action is selected at random, because in all other cases, the market is cancelled.

It however also has the following challenges:

1. 10% of the time, we will need to select an action at random which means this strategy is limited to cases where taking the worst possible action wouldn’t pose an existential risk to the entity using decision markets to make decisions. In some cases, it may be possible to eliminate a large amount of downside risk from this strategy by vetting actions for obvious issues before they are traded on, however false positives and false negatives are inevitable, and the trust assumptions required to implement vetting may be prohibitive for some use cases.
2. The variance of returns is higher which, according to the Kelly criterion, means each trader’s optimal allocation to decision market shares will be lower. This can also be seen as manifestation of volatility drag. As a result, information is less efficiently elicited from informed market participants, due to their optimal position size being lower, causing them to less quickly correct mispricings.

Given the above three discussed decision market strategies, a continuous trade-off space emerges between 1) the need to sometimes choose actions at random 2) having to accept a small amount of confounding and 3) market accuracy (due to higher variance).

             Accuracy  
               / \  
              /   \  
             /     \  
  Confounding-------Randomisation  

Note:

At the beginning of this article a decision market was referenced with the goal of determining the impact of various presidential candidates on GDP. In practice, though, this market is problematic and more so a conditional prediction market than a decision market, as it doesn’t attempt to isolate causality by avoiding confounding. The democratic process used to elect presidents makes no attempt to avoid common cause confounding or reverse causality, as it simply was not designed with decision markets in mind.

Further reading

• https://dynomight.substack.com/p/prediction-market-causation
• https://www.greaterwrong.com/posts/xnC68ZfTkPyzXQS8p/prediction-markets-are-confounded-implications-for-the
• https://www.overcomingbias.com/p/conditional-close-election-marketshtml

Thanks to Zack, Joe, Lajarre, Brian, Metaproph3t, Claude and Markus for helpful discussions and feedback on this article.

If you found this interesting, have feedback or are working on something related, let’s meet: email: me@distbit.xyz, twitter (@distbit0), or schedule a 20 min call

Introduction

Due to the pseudonymous nature of DeFi, all synthetic assets and loans must be over-collateralised. 

In a 100% collateralisation regime, if the value of the collateral decreases at all relative to the loan value, the position becomes immediately under-collateralised and fractionally-reserved.

As many have discovered during the 2022 bear market, this can have dire consequences for lenders and synthetic asset holders, in many cases resulting in complete loss of funds depending on emergency mechanisms.

As a result, it is imperative that all Defi lending and synthetic asset platforms have sound mechanisms in place to ensure that the value of deposited collateral is always greater than the value of their associated obligations. 

In order to ensure this, however, all such platforms must have access to reliable price feeds for each collateral asset that they support. If the price feed is compromised, all funds deposited on the platform are potentially at risk of being stolen. Hence, it is necessary to ensure all price feeds are secure against any attackers looking to manipulate the reported price for their own gain, and to the detriment of users.

The following analysis of price manipulation attacks applies to any platform which facilitates issuance of “IOUs”. This characterisation most notably applies to both lending platforms and synthetic asset platforms. 

For brevity, however, the term “lending platform” is used to refer to both lending and synthetic asset platforms. The term “loan” is used to refer to both loans and synthetic assets.

The principle behind preventing such attacks is to ensure that the cost of executing them is always greater than the amount of user funds they would allow an attacker to steal.

An interesting framework which can be used to analyse the security of a system is outlined here: https://github.com/zack-bitcoin/amoveo-docs/blob/master/basics/trust_theory.md. According to this framework, we are aiming to achieve security level 3.3, which requires that an attack is unprofitable for any attacker, anonymous or not.

For the sake of this analysis, I assume that the oracle itself is not malicious or compromised. As a result, it is expected to accurately report the price of the asset on a single market. The term “oracle” refers to whatever mechanism is used to report market prices to a lending platform. The implications of aggregating multiple markets are discussed later.

Before we discuss how to prevent price manipulation attacks, we should first consider how they work. A price manipulation attack against a lending platform largely consists of two parts:

• Part 1, the “price manipulation”: The attacker buys a large amount of a collateral asset on the open market to temporarily increase its price
• Part 2, the “attack”: The attacker takes a loan out, never to be repaid, against this collateral asset at this inflated valuation

Part 2 is considered an attack because the lending platform has been deceived into believing that the collateral is more valuable than it really is, due to part 1. As a result of this deception, the lending platform will allow the attacker’s loan to be worth more than the un-manipulated value of the collateral. This allows the attacker to effectively trade their less valuable collateral for a more valuable loan, never to be repaid.

Importantly, the amount of the collateral asset which the attacker buys in order to manipulate its price (in part 1) does not necessarily equal the amount which they must deposit as collateral, against which they take out the loan (in part 2).

So, what are the expenses and revenue associated with carrying out such an attack? The revenue is the easiest to analyse. It is the maximum value of assets which the attacker can borrow in the case of a lending platform, or the maximum value of synthetic assets which they can mint in the case of a synthetic asset platform.

The costs can be broken down into two major categories: the cost of manipulating the price feed and the cost of the collateral which must be deposited, against which the loan is taken, or synthetic assets are minted.

Both of the above are included as costs as they represent funds which the attacker must permanently forgo. It is important to ensure this is always the case. 
This is why we place particular emphasis on the case of Uniswap price manipulation attacks below, where this rule isn’t guaranteed to hold.

We can now reformulate the requirement of costs > revenue as:  
manipCost + collateralCost > loanValue  
This inequality is referred to as the “security requirement”, as it is necessary to ensure security against price manipulation attacks.

This is the same as requiring that the attack’s profit < 0 where:

profit = loanValue - collateralCost - manipCost

Where:  
manipCost = cost of manipulating the price of collateral asset X  
collateralCost = value of collateral asset X deposited against which a loan or synthetics were borrowed  
loanValue = value of funds borrowed by the attacker against collateral asset X  
profit = how much the attacker makes by executing the attack  

How do we enforce the security requirement?

We cannot limit how much the attacker deposits in collateral to the lending platform or how much they spend manipulating the collateral price, so all we can do is limit how much they can borrow.

Given that all borrowers on the platform could be controlled by a single individual due to Defi’s pseudonymity, we can only achieve this by limiting the total value of loans able to be issued against each collateral asset. This ensures that even if all funds are borrowed by the attacker, costs are still greater than the value of issued loans. 

To calculate this limit, we simply need to ensure that the total value of all loans secured by each collateral asset is less than manipCost + collateralCost. Here onward, this limit will be referred to as debtLimit.

How do we calculate manipCost and collateralCost?  
In order to do this, we must first define some terms:

Henceforth, the collateral asset having its price manipulated will be referred to as $COL.

First of all, LTV refers to the ratio of maximum loan value to the value of deposited $COL. E.g. If the lending platform allows $0.5 to be borrowed for every $1 of $COL that is deposited, the LTV would equal 0.5.
 
The manipCost, mentioned earlier, refers to the cost of executing the price manipulation. But can we be more specific here? It turns out we can.
The manipulation operation consists of buying $COL on the open market in order to manipulate its price upwards. 

Initially, it might seem that the cost to the attacker is simply the amount they spent to buy this $COL. That, however, would be ignoring the value of the purchased $COL. 
Once we account for the value of this $COL, it becomes clear that the true cost of this attack is the (un-manipulated/true) value of the acquired $COL minus the amount the attacker expended to purchase the $COL. 
This can be succinctly summarised as “slippage cost”. The greater the slippage, the more expensive the manipCost will be for the attacker.

manipFactor is the amount by which the attacker decides to manipulate the price of $COL and is equal to the manipulated price divided by the starting price. For example increasing the price of $COL from $100 to $150 will result in a manipFactor of 1.5.

Finally, the profit is perhaps the simplest term to define, as it is simply the amount that the attacker makes by executing the attack. The security requirement is that profit < 0.

Now that we have defined these terms, we can deduce the amount an attacker can borrow (loanValue) given a certain LTV, manipFactor, and collateralCost:

• LTV is above defined as the ratio of loanValue to collateralCost, so by definition a higher value of LTV will result in a proportionally higher loanValue able to be borrowed against a certain collateralCost worth of $COL.
•  manipFactor is defined above as the ratio of the manipulated $COL price to the original $COL price. A higher manipulated $COL price tricks the lending platform into allowing a proportionately higher loanValue to be borrowed against the same true value of $COL. 

As a result, loanValue = collateralCost x manipFactor x LTV  
This equation implies that both LTV and manipFactor act to multiply the loanValue able to be borrowed against a certain amount of collateral (collateralCost), in alignment with the above explanation.

Given that loanValue can be represented as collateralCost x manipFactor x LTV, we can rewrite the profit equation from above (repeated here to refresh your memory):  
profit = loanValue - collateralCost - manipCost

Substituting gives us:  
profit = collateralCost x manipFactor x LTV - collateralCost - manipCost  
Which can be simplified to:  
profit = collateralCost(manipFactor x LTV) - collateralCost - manipCost  
profit = collateralCost(manipFactor x LTV - 1) - manipCost  

collateralCost is a particularly important here as, if we can find the maximum safe value for collateralCost where profit is still <= 0, we can then plug this into the loanValue = collateralCost x manipFactor x LTV equation in order to arrive at the debtLimit, which will be the resulting loanValue.

The way we achieve this is via the following:

As long as manipFactor x LTV - 1 > 0, an increase in collateralCost will result in an increase in profit in the above equation. It turns out (for reasons we will explore below) that for an attack to occur at all, manipFactor x LTV - 1 > 0 needs to be true, so this is a reasonable assumption.

Given that the highest we can allow profit to be is 0, we can then calculate the maximum safe value of collateralCost via the following steps:

collateralCost(manipFactor x LTV - 1) - manipCost = profit  
collateralCost(manipFactor x LTV - 1) - manipCost = 0  
solve for collateralCost:  
collateralCost = manipCost / (manipFactor x LTV - 1)  

We can now sub this equation for collateralCost into loanValue = collateralCost x manipFactor x LTV to calculate the debtLimit, where the resulting loanValue is the debtLimit:

debtLimit = (manipCost / (manipFactor x LTV - 1)) x manipFactor x LTV  
Which simplifies to:  
debtLimit = (manipCost x manipFactor x LTV) / (manipFactor x LTV - 1)  

So we now know how to calculate the debtLimit, right?  
There is one more piece missing: How manipFactor and manipCost are calculated.

manipCost is calculated by simulating the slippage incurred from filling all of the orders in the $COL ask orderbook until the price has been increased by manipFactor.

A lower debtLimit from a certain manipFactor indicates that the sum of manipCost and collateralCost is lower for an attack employing that manipFactor. This means that all else being equal, the attack is more profitable. 

In order to be resistant to all attacks, we must set the platform debtLimit based on which manipFactor allows for the most profitable attack. This necessitates, therefore that we devise a way to find the manipFactor which results in the lowest debtLimit value, and set the final debtLimit equal to this value.

In order to achieve this, it is important to understand the relationship between manipFactor and manipCost. 
An increase in manipFactor has the following two countervailing effects on the profitability of the attack, and therefore on debtLimit:

• A higher manipFactor results in a higher manipCost, because the higher the attacker manipulates the price, the more slippage they incur. 
      - This is both by virtue of the attacker simply having to fill a greater volume of orders, but also due to each subsequent order offering a higher price than the last and therefore incurring higher slippage.
      - This results in higher costs for the attacker, implying:
          - Lower profitability
          - A higher value of debtLimit
• A higher manipFactor also allows the attacker to borrow a larger loanValue (which constitutes the attacker’s revenue) using the same value of $COL. 
      - This results in higher revenue for the attacker, implying:
          - Higher profitability
          - A lower value of debtLimit

As a result of the above two countervailing consequences of a higher manipFactor, we can not assume that either the highest or lowest values of manipFactor will correspond to the highest or lowest values of debtLimit. 

To see what a graph of the absolute value of debtLimit over the course of a sample orderbook looks like, see the following spreadsheet: https://docs.google.com/spreadsheets/d/14Gxmj3_Vc-XBuf74Cj3xDlFZ3QMGFwZfPCVCw_G7Dgs/edit#gid=885922950.
You can vary the LTV parameter to see the impact of doing so on the shape of the debtLimit curve, after cloning the spreadsheet.

Perhaps most notably, the point at which price manipulation attacks become possible* corresponds to the vertical asymptote in the debtLimit curve. The true (non-absolute) debt limit flips from being negative to being positive at this point. See the section below: “Lower bound on manipFactor x LTV for an attack to be possible” for more information about the significance of this asymptote.

As a result, we must instead calculate debtLimit for all* values of manipFactor and set the final value of debtLimit equal to the lowest debtLimit which this exhaustive search returns. 

*See note: “Lower bound on manipFactor x LTV for an attack to be possible”

Conclusion

We have now calculated a safe debtLimit for $COL such that all attempted price manipulation attacks will be unprofitable. 

This allows any lending or synthetic asset platform to be resistant to such attacks by restricting the value able to be borrowed against $COL to debtLimit. 
Conversely, any platform which allows loanValue > debtLimit to be borrowed in the form of loans or synthetic assets against $COL, is exploitable. 

Furthermore, if a single platform which supports $COL as a collateral asset (with a similar LTV), is exploitable (due to e.g. not enforcing a debtLimit), all other platforms which support $COL as a collateral asset become exploitable as a result. This is because it only takes one exploitable synths/lending platform for the attacker to cover the manipCost of the attack, after which all additional platforms are profitable to exploit. For more on this, see note: “What if $COL is listed on more than one lending market?”.

Further notes

What if $COL was being traded on Uniswap v2 rather than on an orderbook based exchange?
—
The relevant equations for incorporating Uniswap v2 markets in the above debt limit calculations can be found here: https://www.desmos.com/calculator/v1fbncg9c7

The general idea is to construct an equation for the debtLimit at any point on the Uniswap v2 curve and then to find the minima of that equation in the positive quadrant. The minima is found via a binary-search-like approach, numerically rather than algebraically due to the complexity of the equation of the derivative of the debt limit curve. 

All of the above debtLimit calculation logic including for Uniswap v2 has been implemented in a Python codebase which may soon be open sourced.

What if $COL is listed on more than one lending market? 

One of the most obvious limitations of the above as a strategy for preventing price manipulation attacks is that the attacker can amortise the cost of the price manipulation component over multiple lending markets. 

To illustrate this, imagine the scenario where five lending markets support $COL as a collateral asset, all of which employ the above strategy for calculating their $COL debtLimit. 
In this case, they would all be susceptible to a profitable price manipulation attack as the attacker now has debtLimit x 5 revenue potential available which they can use to cover the collateral and price manipulation costs of their attack. 

This suggests that lending platforms may need to coordinate with one another to some degree to share the debtLimit  in order to prevent the aggregate debtLimit between them from exceeding the calculated safe debtLimit. 

This coordination however, seems like something that would be quite difficult to achieve, although perhaps is an interesting area of future research and mechanism design. 

If price manipulation attacks employing this strategy become more common, such coordination will become a necessity for any lending platforms wishing to survive. 

More considerations around Uniswap v2 data feeds

This paper: https://eprint.iacr.org/2022/445 shows that manipulation attacks can be very cheap against the native Uniswap V2 TWAP feed.

Consequently, even though it is possible to calculate debtLimit values for Uniswap V2 markets, price data should only be read from these markets via an oracle mechanism that is able to detect very-short-term outlier price data, such as Chainlink’s oracles. 

The primary reason why Uniswap v2 is particularly vulnerable here relative to orderbook exchanges is that Uniswap orders do not become “filled”, in the “irreversible” sense that orders in orderbooks are “filled”.

This reversibility of Uniswap order filling allows the attacker to cancel out their incurred manipCost, as long as they are able to prevent others from front-running them in this operation (see the paper linked above for more information). This converts the manipCost from a “sunk cost” to a “retrievable cost”, causing the attack to be significantly cheaper to carry out.

Despite the above however, it is possible to securely use Uniswap v2 TWAP feeds by “wrapping them” with a function which applies a geometric mean function to prices periodically sampled from the native v2 TWAP feed. This works because, as explained in the above paper, a geometric mean TWAP is significantly much more resistant to single outlier data points. Consequently, the attacker must continue the manipulation over multiple blocks, which becomes prohibitive using the MEV manipulation strategy outlined in the paper. 

This geometric mean wrapper solution is infeasible in practice though, unless the onchain gas costs are shared by multiple data consumers, as the periodic TWAP samples required by the geometric mean function are estimated to cost $100k+ per year to provision (depending on various gas price assumptions). See this spreadsheet for more details: https://docs.google.com/spreadsheets/d/1T7MIKD_NfAX5mlbfD_jPYPnW4QUYdPaPAhwhALbHzPc/edit#gid=0. 

Considerations relating to Chainlink price feeds  

When using Chainlink price feeds to price collateral deposited to a lending platform, the above analysis can be carried out by aggregating the Ask orderbooks of all markets which Chainlink derives its price data from. 
By then calculating the debtLimit via the method outlined above, on this aggregated Ask orderbook, we can arrive at a cost of manipulating the price of $COL on all markets in which it is traded.

Some of Chainlink’s price aggregators however, (probably) exclude certain markets when calculating the price of $COL. As a result, manipulation of these price feeds would only require manipulation of $COL in a subset of all its markets, lowering costs for an attacker.
This can be accounted for by applying a conservative multiplier (< 1) to the resulting debtLimit derived from the entire market. 

The assumption present in the above however is that Chainlink data aggregators such as Coinmarketcap weight markets according to their liquidity when calculating the avg $COL price. More liquid markets are on average more expensive to manipulate, so assigning them a higher weight makes sense from the perspective of maximising attack costs. 

If however, most price aggregators weigh markets by their trading volume, price manipulation attacks become cheaper as attackers can strategically prioritise manipulation of the highest volume yet least liquid $COL markets. In effect, the attacker gets more “bang for their buck” in these markets than in lower volume and higher liquidity markets. This necessitates a more complex algorithm for calculating the aggregate market debt limit.

Volume-based weightings can be accounted for by prioritising orders from higher volume markets before those from lower volume markets when calculating the manipCost for a certain manipFactor. Orders from increasingly lower volume markets could be included in the calculation until the desired manipFactor has been achieved, at which point the slippage cost of just these orders is used to calculate the manipCost. 
This algorithm effectively simulates how the attacker would go about carrying out their attack, in order to calculate the attack’s cost.

Manipulation of capital asset prices  

There is not that much to say here except that capital asset prices are also subject to price manipulation attacks, resulting in a debtLimit also being required for every capital asset, limiting the total value of each capital asset that can be borrowed at any point in time.

Lower bound on manipFactor x LTV for an attack to be possible  

In order for an attack to be carried out, manipFactor must be greater than 1 / LTV. Another way of stating this is that manipFactor x LTV > 1 . This can be understood both intuitively and also algebraically by simply looking at the denominator of the above debtLimit equation. 

Intuitively, if the manipFactor is less than the reciprocal of the LTV, the attacker simply can not profit from an attack, because they will need to deposit $COL worth more than the value of their loan. This is because the manipFactor effectively acts to cancel out the over-collateralisation effect of the LTV, by allowing the attacker to trick the lending platform into allowing them to borrow more capital against the same value of $COL.

As a result of this, attacks are prevented from being profitable until they are able to manipulate the collateral asset’s price by a manipFactor equal to at least 1 / LTV. 
As a result, low LTV values can be seen as a sort of barrier to manipulation attacks, as they require the attacker to at least be able to achieve a certain manipFactor. This is of course, not to say that collateral assets with low LTVs are safe from price manipulation attacks, just that all else being equal, a lower LTV results in a higher collateral asset debtLimit. 

An interesting implication of this is that collateral assets with very high LTV values (e.g. an LTV of 0.95 as might be used for stablecoin collateral assets with very low volatility) are particularly susceptible to price manipulation attacks, because such small price deviations incur very low manipCost for an attacker due to the low slippage. As a result, collateral assets with very high LTVs, such as stablecoins, will require very low (relative to if a lower LTV was used) debtLimit values to mitigate the low cost of price manipulation attacks.

One problematic way to address this is to hard-code the price of certain stable collateral assets, to prevent any price manipulation attacks from being possible. This however, risks the lending platform becoming insolvent were the value of the supposedly stable collateral asset to decline below its hard-coded price multiplied by its LTV.

This is particularly relevant to crypto-collateralised stables (e.g. DAI) where stable collateral assets are used to maintain a tight peg between the stablecoin’s price and the price it is targeting.

Another use of this insight is that we can restrict the bounds of our search on values of manipFactor when searching for the lowest value of debtLimit to values of manipFactor greater than 1 / LTV. All lower values of manipFactor are irrelevant due to attacks which employ them not causing any damage to the lending platform.

Liquidity withdrawal attacks

Another interesting meta-attack that becomes possible if the above debtLimit calculation strategy approach is adopted is that an attacker could intentionally manipulate market liquidity in order to deceive the lending platform, or to carry out an attack. There are two primary ways this can occur:

1. The attacker could artificially increase the available liquidity in $COL markets over a period of time, resulting in a higher debtLimit being instituted by lending platforms for $COL. The attacker then, at a certain point in the future, removes this liquidity and immediately carries out a price manipulation attack, at a much lower cost than the calculated manipCost given the original liquidity level.
       - (Of course, the attacker could just trade against their own orders w/o pulling them, but this is less capital efficient for them.) 
2. The attacker can create a stealth bribery smart contract to pay Uniswap LPs to simultaneously remove a large percent of the liquidity for a certain Uniswap market at a certain time, at which point the attacker carries out price manipulation against the Uniswap (v3 or v2) market, incurring much lower costs as a result of the reduced liquidity.

The second strategy here becomes more feasible the more liquidity is concentrated among a small set of LPs in the $COL Uniswap market. This is because a more concentrated set of LPs means the attacker needs to coordinate fewer parties in order to execute the attack.

This attack is very difficult to mitigate. Even if the lending platform simply reduced the $COL debtLimit upon becoming aware of such an attack, they expose themselves to a griefing vector if they are willing to disable/hamper their lending market every time an attacker threatens to carry out such a price manipulation attack.

The cost to LPs if they participate in the attack by depositing their LP tokens as a bond in the bribery enforcement contract is very low. This low cost for conspiring LPs is because the bribery contract can allow them to freely bond and un-bond their LP tokens until the point where a predefined threshold of deposited LP tokens is reached.

Only at this point would the contract remove the LP liquidity from the Uniswap pool, allowing for the attack to be executed. 

It is therefore unlikely that the attacker will need to pay LPs unless the attack succeeds, at which point the LPs do incur the cost of having their LP tokens redeemed, causing them to miss out on trading fees. This means that the attack is extremely cheap for the attacker unless it succeeds. As a result, it acts as a significant griefing vector against any lending platforms preemptively hampering their lending markets upon detection of this attack being attempted.

There are two potential solutions to both the first and second liquidity manipulation attacks mentioned here:

• The protocol to can provision liquidity in these markets itself so as to “enforce” a minimum manipCost
• In the case of Uniswap markets, it can pay LPs to deposit their LP tokens into a contract which enforces a time-delay on LP token withdrawals. This guarantees the lending platform e.g. 48 hours notice before the LP tokens are able to be redeemed.

This however, poses a difficulty for collateral assets which are predominantly traded on centralised/off-chain exchanges. In these cases even if “the lending platform” owns or incentivises liquidity, this can not be proven in a trust-minimised fashion to users of the lending platform. As a result, the lending platform’s resistance to price manipulation attacks degenerates to a form of “trust us”.

Additionally, any on-chain “protocol-owned liquidity” is difficult to exclude other lending and synthetic asset platforms from “free-riding” on, potentially resulting in a tragedy of the commons situation. 

It is unlikely this will become an issue in practice though, as the cost of paying a large percentage of existing LPs to “time lock” their LP tokens is probably very low as long as the time-locking period is much less than the period most LPs expect to maintain their LP positions for. 

Resistance of Chainlink price feeds to manipulation  

One might imagine that Chainlink feeds are resistant to the above-described price manipulation attacks for either of the following reasons:

1.  The exchanges from which Chainlink sources price data enforce KYC on users, resulting in any price manipulation risking the attacker being prosecuted and suffering confiscation of funds.
2. Chainlink price aggregators and nodes will remove outlier price data before feeding it to lending platforms.

The first of these arguments is not a sound foundation on which to base any trust-minimised DeFi platform. It results in said lending platform’s security being at the whim of the legal system in whichever jurisdiction a potential price manipulator may reside. 

Such a platform would also be wholly reliant on the effectiveness with which the one or two exchanges that host the most liquid $COL markets are able to differentiate between black-market and genuine KYC documents. The attacker only requires this procedure to fail once, for their attack to succeed. This does not even consider the possibility of insiders and employees at these exchanges using their position to surreptitiously allow a price manipulation attack to take place, in exchange for a bribe.

The second of these arguments also largely does not apply, as outlier detection requires there to be a reference point for comparison of the manipulated data to. No such reference point is available, however, for the manipulated data to be compared with. This is because the entire $COL market is being manipulated, not just a single $COL market which can be easily excluded on the basis of being an outlier when compared to the rest of the market.

Furthermore, outlier detection over time is unlikely to be able to reliably ignore price data resulting from price manipulation attacks as the price will not immediately revert to the pre-attack price and so should remain manipulated for long enough to be included in the Chainlink price record. 

Rather, the price will likely initially slowly revert (due to all sell orders up to the manipulation price already having been “consumed”) until it reaches the threshold where the attacker’s collateral becomes liquidatable. 

Once this threshold is reached, the price will revert more quickly due to liquidators attempting to sell said collateral, only to find very little liquidity available at the inflated prices, resulting in high slippage and a fast reversion back to the pre-manipulation price.

Applying a moving average could also lessen the impact on lending platforms of price manipulation attacks, but only by allowing for higher debtLimit values at the expense of less responsiveness to price changes. 

Modifying a platform’s $COL debtLimit

If a platform initially sets its $COL debtLimit  to the current debtLimit calculated via the above algorithm, the moment liquidity conditions deteriorate at all, the platform becomes exploitable. This is due to the fact that worsening liquidity conditions imply a lower safe debtLimit, implying that the initial set debtLimit is now higher than what is safe.

The solution to this, of course, is to set the platform’s $COL debtLimit to the current calculated debtLimit minus a safety margin (probably around 50%). This creates a buffer, allowing the platform operator to react to changes in liquidity by updating the $COL debtLimit before the platform becomes exploitable. 

How, though, can the platform’s debtLimit actually be decreased?  
An issue arises if the total value of loans taken out against $COL is already greater than the newly calculated debtLimit. If the attacker controls loans collateralised with $COL, worth more than the new safe debtLimit, they can carry out an attack. 

This is particularly important in the context of the section on Liquidity withdrawal attacks, due to the following possible scenario: An attacker may strategically withdraw liquidity from $COL markets, resulting in a safe value of debtLimit decreasing from X to Y.
If initially, the platform’s debtLimit for $COL was greater than Y, the attacker could have taken out a loan greater than the value of Y.  
How can a platform in this situation prevent the attacker from using their pre-existing debt-limit-exceeding loan to attack the platform?

First we must consider whether they even can use an existing loan to carry out an attack, or whether attacks are only possible with loans taken out at the time of the attack. 

The attacker’s goal is to use their open loans to steal from the lending platform by deceiving it as to the value of the attacker’s $COL collateral. They can achieve this using their existing loans in the following way:

• Part 1, the “price manipulation”: The attacker buys a large amount of the collateral asset on the open market, to temporarily increase its price. 
• Part 2, the “attack”: The attacker withdraws most of the collateral they had deposited for their existing loan, leaving their loan undercollateralised (in real terms).

Part 2 is considered an attack because the lending platform has been deceived into believing that the collateral is more valuable than it really is, due to part 1. The attacker has effectively traded the small amount of remaining collateral, for the comparatively larger value of their existing loan, which they have no plans to repay.

Now that we have established that existing debt-limit-exceeding loans can be used to carry out an attack, we must find a way to prevent such attacks.  
The solution is to simply prevent collateral withdrawals for collateral assets where the total loan value exceeds the current debtLimit. This way, there is no need to forcibly close the attacker’s loans, we can simply prevent the attacker from using them to carry out an attack. 

With this limit in place, the attacker won’t be able to execute Part 2 of the above attack, resulting in their attack failing.

But what if the attacker carries out the attack before the platform is able to decrease its $COL debtLimit in response to the decreased liquidity?

The solution to this is that the lending platform can implement a delay on all new price data, as DAI does, giving it time to adjust the debtLimit before the price manipulation can be capitalised on by the attacker.

Thanks to Zack Hess, Brian Pasfield and Max Kaye for the discussions and feedback that contributed to this post!

If you found this interesting, have feedback or are working on something related, let’s meet: email: me@distbit.xyz, twitter (@distbit0), or schedule a 20 min call

• read-only re-entrancy curve
  • explanation
    • only works if one of the assets supports callbacks (i.e. erc777, erc677 or ETH)
    • when lp tokens are burned, the lp token supply is reduced before all of the erc20 collateral is sent to the user
      • as the burn function returns the underlying erc777 tokens to the LP
        • a callback hook on the erc777 token is executed and used to carry out a read-only re-entrancy attack
          • on a contract which supports the LP token in question as collateral.
            • This contract then calculates a manipulated price for the LP token
              • due to temporary distortion of ratio between lp token supply and reserves
  • mitigation
    • ensure that none of assets in pool are ETH, ERC-677 or ERC-777
      • i.e. tokens with callbacks for recipient (when the manipulation involves removing liquidity) and callbacks to sender (when the manipulating involves adding liquidity)
    • call state altering function on lp token contract when reading from LP contract
      • in order to trigger its re-entrancy guard
• high price impact flash loan liquidity manipulation
  • explanation
    • affects lp token pricing implementations which incorrectly assume amm is balanced
      • i.e. those which price LP tokens according to the market value of their reserves without either:
        • requiring that the total value of both reserves are equal
        • substituting the actual reserve amounts with a set of hypothetical reserve amounts
          • which have the same product (K) as the original amounts, while also being of equal value
    • attack consists of:
      • a large trade being made in the LP token’s market prior to the price reading
        • resulting in the LP reserves becoming in-balanced (no longer of equal value)
        • resulting in the total market value (based on the chainlink price of each reserve asset) of both reserves increasing significantly
          • as a result of the trade experiencing high price impact, and hence effectively donating to the reserves
      • once the reserves have been manipulated, the attacker then interacts with the targeted lending protocol by:
        • depositing the LP tokens as collateral, allowing the attacker to borrow an amount greater than the true value of their LP tokens, and never repay their loan
          • (as long as the % by which they increased the LP token’s value is greater than the overcollateralisation ratio of the lending market)
      • once they have taken out their highly profitable loan, they then undo their trade on the AMM, making back the costs they initially incurred in the form of price impact
  • mitigation
    • use fair lp token pricing formula
• donation attack
  • requires attacker to have exposure to LP token > mktcap of lp token
    • so that an $x donation to the LP contract results in > $x profit for the attacker (otherwise donating would be unprofitable)
    • which requires them to be able to borrow the collateral they deposit
      • i.e. this attack is not possible on protocols where collateral can not be borrowed
        • such as fringe or stablecoin platforms which do not lend out or yield farm collateral
  • do not support highly volatile assets as collateral and capital simultaneously:
    • supporting highly volatile assets as:
      • capital: upwards price movement > risks incurring loss for lenders of this asset
      • collateral: downwards price movement > risks incurring loss for lenders of other assets
      • collateral and capital: upwards price movement > risks incurring loss for entire platform
        • importantly, the collateral being borrowed against is loaned out, hence not guaranteed. if only guaranteed collateral was allowed to be borrowed against, the externalisation of the bad debt to the lending platform would not be possible.
  • this attack basically consists of someone lending a capital asset
    • and their borrowers defaulting due to the capital asset appreciating faster than borrowers can be liquidated
      • (in this case, the lender and borrower happen to both be the attacker)
      • usually this would be the end of the story, harming only the lender (attacker)
        • however in this attack scenario, the loss of the lender is externalised onto the platform
          • as they are allowed to borrow against their now (bad/unrecoverable) loaned assets
            • therefore saddling the platform rather than themselves with the bad debt
  • can this attack affect lenders and borrowers of assets other than the assets having their prices manipulated?
    • yes, it affects lenders of whatever assets the attacker decides to borrow using the manipulated asset as collateral
      • or potentially all lenders if the platform decides to socialise losses (this will vary on a per platform basis)
  • how can these be mitigated while still allowing for lending of collateral assets?
    • do not support assets which can change very quickly in value
    • do not allow deposited qty of collateral asset to be > asset’s supply (very hard to enforce this in practise)
    • do not allow borrowers to borrow against collateral asset which has accrued significant bad debt
    • use pessimistic oracle to price collateral for borrowing
      • so that attack can not borrow in same tx as they manipulated
        • and platform has time to stop bad debt from spreading from their account to the rest of the platform
    • do not update price using price data only made available in the current block
      • (although I do not believe flash loans deserve to be subject to such discrimination)
      • this also does not address the root cause, as the attack is possible (just more capital intensive/expensive) without flash loans
  • can other lending protocols be affected by this attack even if they implement mitigations, due to another protocol being exploited?
    • if they support asset as collateral, lenders of the asset will incur bad debt/defaults, but still be ok due to collateral still covering the original value of the assets
    • if the lenders of the asset can borrow against their bad debt, the platform will incur bad debt

Thanks to Torgin for explaining the donation attack mechanism.

If you found this interesting, have feedback or are working on something related, let’s meet: email: me@distbit.xyz, twitter (@distbit0), or schedule a 20 min call

Whether auction has reserve price (reservePrice=true/false)

• special case of this is when it is impossible to attain reward, resulting in an implicit infinite reserve price
• when auction has no reserve price, reward is guaranteed to be earned
  • however there can be no guarantee that costs expended by bidders = reward
    • rather, the difference between total costs expended by bidders and total reward is a function of the heterogeneity of the bidders’ costs
      • i.e when all bidders have almost the same costs, they make ~0 profit and total bidder cost = total reward.

Whether bidder with lowest average cost for entire task is subject to competition from bidders with lower marginal costs for fractions of the task (workDivisible=true/false)

• equivalent to: whether it is possible the marginal costs of the contributor to be higher than the marginal cost of any non-contributors
• this significantly reduces the competition for the auction
  • as the pool of competitors is reduced from those with marginal cost for a fraction of the task that is lower than the clearing price
    • to only those who’s marginal cost for the entire task is lower than the clearing price
  • i.e. this is the case where in order to participate:
    • rather than simply needing a lower marginal cost for a subset of the task, than any of the current participant(s),
      • you actually need a lower marginal cost for the entire task than any of the current participant(s)
        • or in other words, a greater output for the same reward, given that the entire reward is allocated to the winning bidder

Analysis of various instances

• reservePrice = true, workDivisible = true
  • not guaranteed to receive bids, work efficiently allocated amongst bidders
  • examples:
    • extraction of gold in ocean
    • euler liquidations
• reservePrice = true, workDivisible = false
  • not guaranteed to receive bids, work inefficiently allocated to single bidder
  • examples:
    • fixed-discount full liquidation auctions
• reservePrice = false, workDivisible = true
  • guaranteed to receive bids, work efficiently allocated amongst bidders
  • examples:
    • PoW
    • PoS
    • treausury auctions
    • Dai CDP liquidation auctions
• reservePrice = false, workDivisible = false
  • guaranteed to receive bids, work inefficiently allocated to single bidder
  • examples:
    • Proof of VDF

If you found this interesting, have feedback or are working on something related, let’s meet: email: me@distbit.xyz, twitter (@distbit0), or schedule a 20 min call

Tor hidden services is an internet protocol which facilitates communication between two parties without either of them disclosing their IP address to each other or a trusted third party. It is used by tor to allow servers to operate without clients needing to know their ip address in order to connect.

A physical instantiation of THS would be a protocol which allows for physical goods to be transferred between two parties without either party needing to know the location of the other, nor able to easily discover it. Such a protocol would lessen the trust buyers must place in DNM vendors and other physical agorist markets. This is because buyers would no longer be at risk of the vendor leaking/reporting/disclosing the buyer’s postage address.

• Differences between physical and digital THS
  • payload is encrypted in digital THS but not physical THS
    • harder to claim accidental possession if contraband is unencrypted
    • payload can be inspected by state-controlled infrastructure in physical but not digital THS
  • cost to user of payload “drops” is high in physical THS but low in digital THS
  • incentive for relays to steal payload is high in physical THS but low in digital THS
  • cost and difficulty of running physical THS node is much higher than running digital THS node
• Similarities
  • both require relays to have possession of and to transmit/traffic (in some sense) potentially illegal material
  • both physical and digital THS can facilitate regulatory arbitrage by way of employing relays only in friendly jurisdictions
  • in both, identification of payload recipient by sender is hampered
    • due to high coordination/collusion costs
      • due to circuit relays being controlled by multiple randomly selected individuals in multiple jurisdictions
  • both require some jurisdiction to exist which allows for nodes to operate
• Misc notes
  • The advantage of physical THS over dead drops is that dead drops place very little between the sender and the recipient
    • therefore making the recipient vulnerable to identification by a malicious/state-allied sender
  • web of trust reputation can mitigate theft risks of physical THS
• Possible project
  • A decentralised tor hidden services protocol
    • using
      • dead drops
      • postage systems
    • web-of-trust-index reputation system
    • every hop is managed by the sender of the item
    • transporters specify if the item is in a good state when they pick it up
      • so that the previous transporter can be given a bad reputation
  • To facilitate agorism-index.

If you found this interesting, have feedback or are working on something related, let’s meet: email: me@distbit.xyz, twitter (@distbit0), or schedule a 20 min call