4. Assumptions and threat model

This chapter states the conditions under which every guarantee in this document holds, the principles the rules are built on, the adversaries the protocol defends against, and the risks it accepts without defence. A guarantee stated anywhere in this document is conditional on the assumptions of section 4.1.

4.1 Assumptions

• The network is asynchronous: it delays, reorders, and drops messages, and liveness is guaranteed only after an unknown global stabilization time.
• At most f = ⌊(n − 1)/3⌋ of n validators are Byzantine (N3f1), so n = 7 tolerates 2.
• BLAKE3, Keccak256, Ed25519, secp256k1, P256, and BLS12-381 are unbroken.
• The settlement chain's own finality holds for credit imports.
• Every other party, including every node that is not a validator, is untrusted.

Indexers, gateways, and the history query tier are derived views, and are among those untrusted parties.

R-4.1. A derived view MUST NOT be treated as a trust boundary.

The obligations a derived view itself carries, including exposing the finalized height it reflects, are in ../docs/history-query.md.

4.2 Design principles

This subsection is informative. The principles motivate rules that are stated normatively in later chapters.

1. Every externally supplied value is adversarial. Every derived header field, including roots, targets, counts, hashes, and the active release, is re-derived by the verifier. Every proposer-chosen field, including the timestamp and the body, is validated against its constraints. A well-encoded field is never trusted.
2. Three fault outcomes are never conflated: permanent invalidity, which rejects; transient local inability, which stays pending; and fatal local corruption, which stops and recovers. A storage read error is never a vote.
3. Worst-case resources are reserved from the payload shape before any signature check or execution.
4. Only what execution must prove is merkleized. Query indexes are never in a root.
5. Validators are compact: state proportional to active records, logs windowed, history served from the store.
6. Cheap checks precede expensive cryptography everywhere.
7. The trust boundary is at the target. Sync sources and proof servers are untrusted; targets come from certified headers or pinned genesis.
8. Canonical bytes have one encoding, decode with exact consumption, carry explicit bounds, and use architecture-independent widths.
9. Determinism comes from flat order. Parallelism is an implementation strategy that must be result-equivalent.
10. Calibration values are named placeholders until measured. This document invents no number; where a value appears it is a recommended default awaiting the calibration gate.

4.3 Adversaries defended against

Under the assumptions of section 4.1, the protocol defends against:

• a Byzantine proposer that consumes verification work or permanent bytes,
• a malicious client or gateway replaying, reordering, or forging witnesses,
• a compromised delegated key spending within its class,
• an untrusted relayer,
• a lying exporter, proof service, indexer, or query tier,
• under DynamicReshareV1, a departing validator that goes offline early, or a dealer that equivocates after restart,
• a username sniper after grace (accepted, stated),
• a fresh node fed a stale bootstrap list, up to the weak subjectivity of section 13.5: certificate verification of every observed finalization is what the protocol defends with, and a stale list leaves the joiner trusting its operator's choice of anchor.

4.4 Accepted risks

The following are accepted and stated, not defended against.