WikiDeck/wikideck
3
0
Fork 1
Code Issues 8 Pull Requests Actions Packages Projects 2 Releases Wiki Activity

Custodial markets

Browse Source
This commit is contained in:
eric
2026-10-20 14:04:59 -04:00
parent 4e753b35fe
commit fc65e497a8
13 changed files with 1027 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/settlement-feasibility.md
+4 -2
View File
@@ -2,6 +2,8 @@
Status: **proposed; research checkpoint, not an approved exchange protocol**. Source review: 2026-10-20. Related: [production plan](production-plan.md). No processor instance, credentials, wallet or funds were accessed. No swap implementation was installed or run.
**Direction update, 2026-10-20:** the operator has authorized implementing a pooled custodial XMR balance model instead. [ADR 002 — custodial market design](custodial-market-design.md) tracks the implemented isolated sandbox foundation and remaining production work. The recommendations and next gates below are retained as the earlier trustless/arbitrated research record, not a requirement to implement multisig first. Live funds, treasury key access, production fee-policy activation and new consensus activation remain gated. The distinctions between proof, trust, custody and atomicity below still apply.
## Decisions and recommendation
- Operator approved preparatory on-chain NFT locks/reservations for design research. They must not transfer completed-sale ownership before the agreed XMR condition. This does **not** approve a custodian, lock authority, timeout or new consensus rule.
@@ -9,7 +11,7 @@ Status: **proposed; research checkpoint, not an approved exchange protocol**. So
- No practical reviewed Wikideck-compatible trustless design has yet been demonstrated. This is an evidence gap, **not a proof of impossibility**. M0 remains open pending protocol specification, disposable-fixture spike, failure tests, specialist review and operator approval.
- Do not connect SHKeeper or replace trustless exchange with host attestation/custody by default. If the researched route fails its gates, return for explicit fallback approval.
**Recommended path forward:** build proof-backed order evidence and fair, host-scoped reputation as a non-settlement safety layer; for future live fixed-price sales, evaluate per-order 2-of-3 Monero multisig escrow with independent dispute arbitration as the pragmatic buyer-protection candidate. Keep permissionless conditional XMR↔NFT research separate. A payment proof and delivery record cannot return direct-to-seller XMR. The escrow candidate is **arbitrated, not trustless**: the arbitrator and wallet/recovery procedures become material trust and availability dependencies. This recommendation does not authorize live funds, key custody, or new consensus rules; independent security review and explicit release gates remain mandatory.
**Earlier recommendation (superseded as the preferred investigation):** build proof-backed order evidence and fair, host-scoped reputation as a non-settlement safety layer; evaluate per-order 2-of-3 Monero multisig escrow with independent dispute arbitration as a live-sale candidate. Keep permissionless conditional XMR↔NFT research separate. A payment proof and delivery record cannot return direct-to-seller XMR. The escrow candidate is **arbitrated, not trustless**: the arbitrator and wallet/recovery procedures become material trust and availability dependencies. No live funds, key custody, or new consensus rules were authorized by that recommendation.
## Evidence and compatibility boundaries
@@ -111,7 +113,7 @@ The operator's proposed accountability route is technically plausible as a **mar
**Implementation recommendation:** proceed with an offline evidence and case-journal prototype for fixed-price abuse prevention; do not require buyers to publish transaction keys/proofs without explicit consent. A buyer can submit Monero proof, txid, order-specific recipient address and exact amount; a named verifier checks it against a synced chain view and later correlates it with the canonical Wikideck transfer. Record evidence and an appealable case; a host may apply a local restriction only under a published review policy. This is not automatic settlement, a global blacklist or buyer compensation. Keep M0's consensus proof and two-sided atomicity questions open.
## Recommended product path after comparing XMR market patterns
## Earlier recommended product path (superseded by custodial investigation)
**Recommendation: use layered protection, with an opt-in evidence/reputation layer now and an arbitrated multisignature escrow as the first serious live-sale candidate. Do not treat proof/reputation as settlement, and do not make direct-to-seller XMR the default live purchase.**