Protocol mechanics
Deal lifecycle
The buyer assembles exact terms, the seller signs them with EIP-712, and the buyer calls openDeal() with the seller signature and escrow funds.
Normal route
openDeal()creates a funded deal and transfers the buyer principal into the escrow.postBond()transfers the seller bond when the signed terms require one.submitDelivery()stores a non-zero evidence hash.recordVerification()stores Pass, Fail or Inconclusive and starts the full challenge window.accept()lets the buyer settle a Pass, or anyone callsfinalize()after an unchallenged window.
State machine
| State | Entered by | Valid next routes |
|---|---|---|
Funded | openDeal() | Post bond, deliver, timeout or mutual cancellation |
Delivered | submitDelivery() | Verifier verdict, timeout or mutual cancellation |
Verified | recordVerification() | Buyer accepts Pass, disadvantaged party challenges, permissionless finalization, or mutual cancellation |
Disputed | challenge() | Arbitrator ruling, lapsed-ruling finalization, evidence events, or mutual cancellation |
Released | Pass/release settlement | Withdraw credited balances |
Refunded | Fail/refund/timeout settlement | Withdraw credited balances |
Cancelled | Mutual cancellation | Withdraw unwound balances |
Clocks
| Clock | Starts | Expiry effect |
|---|---|---|
Seller acceptance openBy | Off-chain when signed | Opening reverts after expiry. |
| Delivery/verification deadline | At open: block.timestamp + duration | Anyone may claim timeout while Funded or Delivered. |
| Challenge window | When the verifier records a verdict | Anyone may finalize the unchallenged verdict. |
| Ruling window | When a challenge is opened | Anyone may finalize the standing verdict and return the challenger bond if the arbitrator stayed silent. |
| Cancellation offer | At its signed issuedAt | Offer expires and is also invalidated by any deal revision change. |
Disputed route
Only the party disadvantaged by the standing verdict may challenge it: the buyer for Pass, or the seller for Fail or Inconclusive.
The challenge posts the signed challenger bond and moves the deal to its named arbitrator. ConsoleArbitrator lets its agent key propose Release or Refund, lets its officer replace that outcome while the override window is open, and requires someone to call push() afterwards.
| Standing result | Terminal credit |
|---|---|
| Release | Seller receives principal, posted seller bond and challenger bond. |
| Refund | Buyer receives principal, slashed seller bond and challenger bond. |
| Arbitrator silence | After the ruling deadline, anyone finalizes the standing verifier verdict and the challenger bond returns. |
Allocation rules
Settlement writes internal token credits before beneficiaries withdraw. A Pass, accepted Pass or Release credits principal and any posted seller bond to the seller. Fail or Inconclusive refunds principal and returns the posted seller bond unless a disputed Refund ruling slashes it to the buyer. The challenger bond goes to the winner on a ruling; it returns to the challenger when arbitration lapses or a disputed deal is mutually cancelled.
Other exits
A pre-verdict timeout refunds the buyer and returns a posted seller bond without slashing. Buyer and seller may mutually cancel any non-terminal deal, including a disputed one; cancellation unwinds the balances but cannot express a negotiated partial payout.
A cancellation offer is revision-bound, time-limited and signed by one party; the counterparty submits it. Any intervening deal action changes the revision and invalidates the stale offer.