Source-linked AI summary
Augur: a decentralized oracle and prediction market platform
Jack Peterson, Joseph Krug, Micah Zoltu, Austin K. Williams, Stephanie Alexander
TL;DR
Augur addresses decentralized market resolution by combining automated trading with REP-based reporting, disputes, and forks. The paper formalizes when the forking protocol has integrity and shows that honest dispute winners receive a 40% ROI unless another fork interrupts the market.
Problem
Augur’s oracle must preserve correct market resolution against economically rational attackers while avoiding reliance on centralized control.
Method
The paper analyzes attack benefits, dispute costs, REP market capitalization, fork participation, and protocol conditions for integrity.
Results
40% ROI is paid to REP holders who successfully dispute an outcome in favor of the final outcome, unless another market causes a fork.
Takeaways & Limitations
Augur’s security depends on making honest resolution economically preferable through dispute incentives and sufficiently costly attacks.
Takeaways & Limitations
Integrity cannot be guaranteed because the amount of REP migrating to the True universe is unknown and the analysis assumes rational participation.
Abstract
from arXiv · showhide
Augur is a trustless, decentralized oracle and platform for prediction markets. The outcomes of Augur's prediction markets are chosen by users that hold Augur's native Reputation token, who stake their tokens on the actual observed outcome and, in return, receive settlement fees from the markets. Augur's incentive structure is designed to ensure that honest, accurate reporting of outcomes is always the most profitable option for Reputation token holders. Token holders can post progressively-larger Reputation bonds to dispute proposed market outcomes. If the size of these bonds reaches a certain threshold, Reputation splits into multiple versions, one for each possible outcome of the disputed market; token holders must then exchange their Reputation tokens for one of these versions. Versions of Reputation which do not correspond to the real-world outcome will become worthless, as no one will participate in prediction markets unless they are confident that the markets will resolve correctly. Therefore, token holders will select the only version of Reputation which they know will continue to have value: the version that corresponds to reality.
I. HOW AUGUR WORKS
Augur markets progress from creation through trading, reporting, and settlement, with outcomes determined through REP-backed reporting and community dispute. Its contracts support open trading and market creation while keeping reporting incentives and costs low.
- Market lifecycle: Markets progress through creation, trading, reporting, and settlement, with traders closing positions after the oracle determines the outcome.Anyone can create a market on a real-world event, and trading begins immediately after creation.
- Reporting and resolution: REP holders report outcomes by staking on possible results, and reporter consensus determines the market outcome.REP is used for reporting and market creation, not for trading.
- Market creation: Market creators specify the resolution source, creator fee, validity bond, and creation bond when establishing a market.The validity bond is returned for non-invalid markets, while the creation bond depends on timely and correct designated reporting.
- Trading: Trading uses an on-contract order book and automated matching engine that immediately fills matching orders and places unfilled portions on the book.The engine sequesters only the minimum shares or cash needed to cover value at risk.
- Trading: Orders respect traders’ limit prices, may execute at better prices, and incur fees only when complete share sets are sold.Shares and other Augur assets remain transferable after market creation.
C. Reporting
After an event ends, Augur moves from designated reporting into open reporting when necessary, then into dispute rounds. REP holders are rewarded for reporting participation and monitoring the platform.
- Reporting: Augur’s oracle uses profit-motivated REP holders to report real-world outcomes, rewarding reports consistent with objective reality.Anyone owning REP may participate in reporting and disputing outcomes.
- Reporting incentives: Reporting operates in consecutive 7-day dispute windows, with fees distributed proportionally to REP staked or participation purchased during each window.Participation includes initial reporting, disputing, or purchasing participation tokens.
- Pre-reporting: The pre-reporting phase runs from the start of trading until the market’s event occurs, after which designated reporting begins.This is generally the market’s most active trading period.
- Designated reporting: The designated reporter has up to 24 hours to report; failure forfeits the creation bond and triggers open reporting.A timely report places the creation bond as stake on the reported outcome before dispute rounds begin.
- Open reporting: When designated reporting fails, the first public reporter receives the forfeited creation bond as stake and needs no personal REP stake.The reporter may claim the bond only if the reported outcome matches the final outcome.
- Transition to disputes: An initial report becomes tentative and starts a dispute round, allowing REP holders to challenge the proposed outcome.This applies whether the initial report came from the designated reporter or a first public reporter.
7. Dispute Round
Augur resolves tentative outcomes through REP-backed dispute rounds, escalating bond requirements and eventually finalizing the market or triggering a fork. Forks create outcome-specific universes but impose substantial operational disruption.
- Dispute Round: A dispute round lets any REP holder challenge a tentative outcome by staking on an alternative outcome.A challenge succeeds when its total dispute stake reaches the bond required for the current round.
- Dispute Round: The dispute bond B(ω, n) is calculated from total market stake A_n and existing stake S(ω, n) on the proposed alternative outcome.The bond design is intended to provide a fixed ROI for successful disputes of false outcomes.
- Dispute Round: Participants can crowdsource dispute bonds, and any alternative outcome reaching the required stake successfully displaces the tentative outcome.A single user does not need to fund the entire dispute bond.
- Escalation: A successful dispute causes another round, a waiting phase, or a fork depending on the filled bond size.Bonds from 0.02% to below 2.5% of theoretical REP trigger waiting and another dispute process, while bonds at least 2.5% trigger a fork.
- Finalization: If no dispute succeeds, the tentative outcome becomes final and Augur’s contracts pay out according to it; unsuccessful dispute stake is returned.Final outcomes are treated as truth for settlement.
- Fork: A fork lasts up to 60 days, creates one child universe per possible outcome, and permanently locks the parent universe.REP holders migrate one-way to a chosen child universe, while unmigrated tokens are permanently locked after the period.
10. Finalized
A market finalizes after its outcome survives a dispute round or is determined through a fork, after which traders settle positions and fees reward reporting participants.
- A market finalizes after passing through a 7-day dispute round without successful dispute or after a fork.
- Before finalization, traders can sell shares to one another for currency rather than settle with the market.
- Finalized markets let traders redeem a winning-outcome share for 1 DAI minus fees.
- Settlement fees consist of creator and reporting fees, both proportional to the amount paid out.
- When a market finalizes without a fork, losing REP is forfeited; 20% is burned and the remainder rewards REP staked on the final outcome.
- Successful disputes of the final outcome provide a 40% ROI on dispute stake, rewarding reporters who correct false tentative outcomes.
II. INCENTIVES AND SECURITY
Augur secures decentralized resolution by making attacks cost more than their maximum benefit, while acknowledging that parasitic open interest limits objective security guarantees.
- II. INCENTIVES AND SECURITY: Forks are disruptive and time consuming, taking up to 60 days and suspending finalization of other non-finalized markets.
- II. INCENTIVES AND SECURITY: The credible threat of a correctly resolving fork supports incentives for honest behavior without requiring a fork for every market.
- II. INCENTIVES AND SECURITY: A successful attack can move all non-finalized markets to a false universe and potentially capture their escrowed funds.
- II. INCENTIVES AND SECURITY: The maximum gross attacker benefit is Ia + Ip, combining native and parasitic open interest.
- II. INCENTIVES AND SECURITY: Augur measures native open interest Ia, but parasitic open interest Ip may be unknowable because offline parasitic markets can be arbitrarily numerous and large.
- II. INCENTIVES AND SECURITY: Security can therefore be asserted only if parasitic open interest is assumed to be reasonably bounded in practice.
3. Minimum Cost of a Successful Attack
The attack analysis compares an attacker’s maximum benefit with the minimum cost of migrating REP to a false universe, yielding formal integrity conditions for Augur’s fork protocol.
- 3. Minimum Cost of a Successful Attack: The cost model uses P for REP price, M for total REP supply, and S for the proportion migrated to the True universe.
- 3. Minimum Cost of a Successful Attack: A successful attacker must migrate at least SM REP to a false universe, costing (P − Pf)SM.
- 3. Minimum Cost of a Successful Attack: If S > 1/2, an attack is impossible because insufficient REP remains outside the True universe for a False universe to win.
- 3. Minimum Cost of a Successful Attack: The oracle resolves to objective reality against economically rational attackers when Ia + Ip < (P − Pf)SM or S > 1/2.
- 3. Minimum Cost of a Successful Attack: The integrity property is defined by S > 1/2 or Ia + Ip < (P − Pf)SM.
- 3. Minimum Cost of a Successful Attack: The market cap security theorem requires Pf < P and REP market capitalization greater than (Ia+Ip)P / ((P −Pf)S), alongside the S > 1/2 case.
B. Our Assumptions and Their Consequences
Augur’s integrity analysis depends on assumptions about REP migration, parasitic open interest, and rational participant behavior. Under these assumptions, the protocol targets sufficient REP market capitalization and uses forks and fee adjustments to protect truthful resolution, while several unresolved risks remain.
- Assumptions: REP sent to a False universe is modeled as worthless because users are expected to avoid markets whose oracle has lied.This assumption sets P_f = 0 and underpins the economic analysis of attacks.
- Assumptions: The protocol assumes attackers will migrate no more than 50% of theoretical REP to a false universe because greater migration unnecessarily increases attack cost.The supporting footnote states that exceeding this amount increases cost without benefit.
- Consequences: Under the stated migration and parasitic-interest assumptions, REP market capitalization must be at least 3 times native open interest for fork integrity.The analysis assumes at least half of REP migrates to the True universe and native open interest is at least twice parasitic open interest.
- Consequences: Augur estimates REP market capitalization and native open interest, then adjusts reporting fees toward the target ratio, bounded between 0.01% and 33.3%.Fees rise when capitalization is below target and fall when it is above target.
- Consequences: Forks are intended as a rare last resort because they are disruptive and slow, while their threat is used to resolve markets efficiently.Correct-outcome disputes receive a 40% return on dispute stake, whereas false-outcome REP loses economic value in a fork.
- Risks: Parasitic markets can reduce reporting fees and REP market capitalization, potentially jeopardizing fork integrity and Augur’s long-term viability.The oracle parasite problem remains unsolved, although no significant parasitic interest had been observed at the time of writing.
- Risks: Sudden short-lived open-interest increases can raise the required REP market capitalization faster than the protocol’s seven-day reactionary adjustments.Speculative REP purchases may shorten the vulnerability, and a security multiplier of 5 is intended to absorb increases up to 66.6%.
C. Inconsistent or Malicious Resolution Sources
Augur relies on market creators to choose consistent, objective resolution sources, but malicious or ambiguous sources can create disputes, forks, and delays. The protocol therefore places responsibility on reporters to identify unsuitable markets and coordinate invalid outcomes.
- Resolution sources: An inconsistent or malicious resolution source can cause honest reporters to lose money when determining a market’s outcome.The market creator selects the source, so a bad choice can directly undermine reporting.
- Resolution sources: A creator-designated reporter can exploit a self-controlled source by reporting one outcome while changing the source to support another.In the example, honest reporters dispute the initial outcome using the altered website, creating an attack variation.
- Resolution sources: Reporters should publicly identify dubious resolution sources and coordinate to finalize such markets as Invalid, because simply ignoring them is insufficient if they trigger a fork.A fork would require all REP holders to choose a child universe.
- Self-referential markets: Self-referential markets can create perverse incentives for designated reporters to fail to report when trading profits exceed the forfeited creation bond.A market about whether reporters will fail to report could encourage intentional non-reporting.
- Self-referential markets: Even with sufficient REP market capitalization, self-referential queries may delay finalization and disrupt Augur, although markets would still finalize correctly.The protocol’s integrity may remain intact while performance is negatively affected.
- Market suitability: Only events with objectively knowable outcomes are suitable; ambiguous, subjective, or untimely events should resolve as Invalid.Invalid markets pay traders equal values across possible outcomes, with a separate halfway rule for scalar markets.
- Market suitability: Disagreement between a market’s intended meaning and its literal wording can leave REP holders with conflicting interpretations and create difficult resolution cases.Centralized platforms can declare an outcome unilaterally, whereas Augur relies on REP holders’ resolution decisions.
Appendix A: Finalization Time & Redistribution
The appendix formalizes dispute-round stake accounting and shows that successful disputes grow the stake on the eventual outcome, yielding redistribution to correct disputers and a bounded resolution time.
- Notation: The analysis defines S(ω, n) as stake on outcome ω and A_n as total stake at the beginning of dispute round n.These quantities support the recurrence and balance arguments used to derive redistribution and the round bound.
- Stake accounting: Successful dispute bonds add stake to the disputed-for outcome, while unsuccessful dispute stake is returned to users.The total stake at the next round therefore increases only by the successful bond from the previous round.
- Redistribution: 40% ROI is paid to REP holders who successfully dispute in favor of the market’s final outcome, unless another market causes a fork.Augur burns 20% of non-final stake and redistributes the remainder proportionally to final-outcome stakers.
- Finalization: A market’s final outcome has exactly twice as much stake as all non-final outcomes combined when it resolves without a fork.This follows when the final tentative outcome is not successfully disputed in its final round.
- Finalization: At most 20 dispute rounds are required before a market finalizes or causes a fork, provided no other market interrupts reporting.The bound follows from the slowest-growing dispute-bond sequence, in which the same two outcomes are repeatedly disputed.
Appendix B: Bond Size Adjustments
Augur dynamically adjusts validity and creation-related bonds using participant behavior during the previous dispute window.
- Bond inputs: The creation bond is the maximum of the no-show bond and designated-reporter bond tracked by the system.These component values are used to compute the creation bond but are not exposed to users.
- Adjustment rule: Bond adjustments target observed undesirable behavior, leaving the bond unchanged at a 1% rate and scaling it down or up when the rate is lower or higher.The adjustment can reduce a bond by as much as half or increase it by as much as a factor of 2.
1. Validity Bond
The validity bond is initialized at 0.01 ETH and adjusted according to the fraction of recently finalized markets that were invalid.
- Validity-bond rule: 0.01 ETH is the first-dispute-window validity bond and its floor after later downward adjustments.The bond increases when more than 1% of recently finalized markets were invalid and decreases when fewer than 1% were invalid.
- Validity-bond rule: The current validity bond uses the previous window’s invalid-market proportion and prior bond amount as adjustment inputs.The passage denotes these inputs by ν and b_v before applying the adjustment rule.
2. No-Show Bond
The no-show bond starts at 0.35 REP and is adjusted toward a 1% designated-reporter no-show rate, with a 0.35 REP floor.
- No-show-bond rule: 0.35 REP is the initial and minimum no-show bond, which is adjusted upward or downward based on the previous window’s no-show rate.The target rate is 1%.
- No-show-bond rule: The current no-show bond is computed from the previous no-show proportion and prior bond using a floor of 0.35 REP.The passage denotes these inputs by ρ and b_r.
- Scope caveat: The stated formula may change once empirical data from live markets becomes available.This caveat limits the permanence of the presented adjustment formula.
3. Designated Reporter Bond
The designated reporter bond is adjusted between dispute windows based on prior reporting accuracy, with a minimum initial amount of 0.35 REP.
- 0.35 REP is the designated reporter bond during the first dispute window after launch.
- The bond is dynamically adjusted according to incorrect designated reports from the previous dispute window.
- The current bond equals max {0.35, b_df(δ)}, where δ is the previous window’s incorrect-report proportion and b_d is its designated reporter stake.