Security

Mechanism

Summary — Understand movement limits, delivery duties, price risks, and the limits of competition rewards.

On this page (8)

Sapio limits reserve changes and assigns delivery responsibility. These controls do not guarantee safe assets, accurate prices, or profitable participation.

Fig · Security controls5 controls
01
Eligible Tokens
Only tokens that meet the protocol rules can enter a competition.
02
Limited Change
The volume limit restricts each target change. The system position represents the existing reserve mix.
03
Public Purchases
Public sellers deliver required assets. Price limits restrict what the protocol can pay.
04
Delivery Responsibility
Proposers must deliver their remaining share. An undelivered share loses reward eligibility.
05
Later Rewards
Eligible positions compete at later price checkpoints. Each checkpoint determines part of the payout.
The first four controls govern reserve changes. Later price performance determines rewards.

The main threat

An attacker can try to place a weak or overpriced asset in the reserve. SRT holders can lose value if the reserve acquires it.

Performance scoring happens after settlement. It changes SAPIO payouts. It does not prevent the initial purchase.

Eligible assets

An asset must meet the configured transfer, pricing, liquidity, and accounting requirements. Wrapped assets also need checks on their underlying assets.

Eligibility is not an endorsement. An eligible asset can still lose value or fail.

Bounded changes

The system benchmark represents the current reserve. Proposer stake can move the target away from that benchmark.

The competition limit caps each asset's target weight change. More stake cannot remove that limit.

Separate rules cap purchase instructions and proposer responsibility. Basket deposits and redemptions can change physical delivery quantities. The agreed expansion limit still applies to proposer delivery.

These limits constrain protocol actions. They do not bound every market loss or an attacker's total profit.

Settlement prices

Public sellers can supply instructed assets before proposers must deliver. Each asset has its own quote and price limits.

Invalid live price data can pause a public quote. A pause does not extend the public window.

The public window does not guarantee a fill, sufficient liquidity, or the lowest price. Each fill reduces only that asset's remaining instruction.

Delivery responsibility

After the public window, proposers must deliver their assigned remainder. Stake that matches the current basket carries no responsibility for that matched share.

An undelivered share loses reward eligibility. Governance can also confiscate part of the related stake. The confiscated share joins the system benchmark.

The remaining ineligible stake becomes reclaimable at finalization. It leaves the SAPIO pool and does not receive later payouts.

Delivery connects the instruction to reserve assets. It does not guarantee that sourcing or delivery will be profitable.

Fixed reference prices

Each competition fixes reference prices before entry. Later checkpoints measure price changes from those fixed prices. Purchase prices do not replace them.

Payouts depend on relative performance across the SAPIO pool. Beating the benchmark does not guarantee a net gain. A weaker position can gain stake if other positions perform worse.

The release rules set a minimum fraction for each release event. This limit concerns release events, not calendar time. Delayed settlement or missing prices can delay payments.

Several checkpoints spread evaluation over time. They do not guarantee truthful prices. Thin markets and predictable checkpoints can still create attack opportunities.

What the formal result covers

The formal analysis gives a conditional loss result for a proposer's competition account. It fixes the eligible positions after settlement.

The result requires these conditions:

  • Independent public sellers completed every instruction before the deadline.
  • The system benchmark has positive stake.
  • Prices resist manipulation.
  • Settlement does not create the scored return through its own price impact.
  • The expected reward share is below the participant's share of the stake pool.

Under these conditions, the competition account has an expected loss. The result does not count every outside activity, such as inventory sales or derivatives.

It does not prove that every attack loses money. It also does not prove an optimal reserve across repeated competitions.

Redemption and remaining risks

Proportional minting and redemption can continue during settlement. They need working contracts and transferable reserve assets.

Redemption returns assets, not a fixed cash amount. Asset failures, price errors, market losses, governance decisions, and contract defects remain risks.

See Competitions for the sequence. The Settlement Reference explains the detailed limits.