Pricing a Finding

The bid ceiling is the buyer's estimate, discounted three times

The buyer starts from what repeating the work would cost it, 4,200 USD minor units ($42), and discounts it by how likely that spend was.

Each factor is a basis-point share of the line above. A 60 percent chance the buyer would have run the work at all leaves 2,520. Overlap with sibling findings it already holds removes a quarter, leaving 1,890. A deterministic_replay guarantee keeps the full multiplier, so the discounted estimate stays 1,890. The ceiling is the smaller of that and the 10,000-unit remaining budget: 1,890 minor units, or USD 18.90.

The helper, finding_bid_ceiling(), computes floor(estimate * would_run * (10000 - redundancy) * guarantee / 10000^3) with checked u128 intermediates, rounds down exactly once, and caps the result at policy.budget_remaining_units. The ceiling rises with the estimate and falls as sibling_redundancy_bps grows. It bounds a bid and assigns the finding no objective value; a price within it still goes through purchase admission at the kernel.

Read more in Paid reveal, where the accepted price becomes a hold.

A sale clears only below the buyer's private ceiling

A finding's value to a buyer is a counterfactual it cannot compute. The market prices the buyer's outside option instead: the cost of re-deriving the same result, discounted for how likely it was to try, what a sibling finding already covers, and how strong the seller's guarantee is.

value      = P(would have attempted) x cost-if-attempted
             x P(would have hit the same dead end)
             x redundancy-across-siblings x decay

clears     0 < price <= buyer_local_ceiling

Re-derivation is a meterable action, so the buyer builds the estimate from its own metering history or from a fresh quote for the same context and recipe. That estimate is buyer-local policy. A MeteredBillingQuote rides on GovernedTransactionIntent.metered_billing as caller-carried data, and the kernel checks its shape, time, and currency consistency; it carries no issuer signature, no binding to a finding context or replay recipe, and no proof of who derived the number or how, so it supplies no market-wide substitute price.

The seller posts a unilateral price, ListingPricingHint.price_per_call, on the signed pricing hint at publish time. The marketplace checks currency equality first, then refuses a buyer's max_price_per_call below the posted price with BiddingError::BidCeilingTooLow. Production cost sets no floor: it is sunk, marginal delivery cost is near zero, and a seller recovers it only when enough buyers' private ceilings sit above its ask.

• What the bid reveals. The signed BidRequest carries only max_price_per_call. An operator can audit that the ceiling was enforced; the estimate, would_have_run_bps, and sibling_redundancy_bps stay private planner policy.
• How price forms. There is no auction, order book, counter-offer, or per-buyer price discrimination. Sellers price against recent_receipts_volume, a demand signal the provider advertises on the hint without independent proof.

Each guarantee class discounts by how far a buyer can re-check it

guarantee_class_bps reads off the three-class taxonomy every finding is sold under. The suggested multipliers are policy defaults, and an operator retunes all three per namespace.

The metered_attested discount is the buyer's self-insurance against honest-cost fabrication: a seller can meter a run truthfully and still be wrong about what the run proves. The multipliers follow the reputation-tier discount idiom, TIER_DISCOUNT_PER_HUNDRED. One rule holds in every namespace: an asserted claim stays asserted until independently re-verified, the never-upgrade discipline that property P10 carries for status reporting in the Lean obligations report_truthfulness_asserted_not_verified and report_truthfulness_observed_not_verified.

Collateral sized to every open sale prices dishonesty

Seller revenue finalizes at capture. The purchase takes a short-lived reversible hold before delivery and captures it right after a matched delivery, so no post-sale window holds the money; the collateral carries that risk instead.

encumbrance_per_sale = k * accepted_price                  k >= 1

base_finding_stake + sum(open_encumbrances)
    <= min(locked_amount - slashed_amount, listing_requirement.required_amount)

sum(open_encumbrances) <= maximum_sale_exposure

Admission resolves an unspent seller-collateral allocation from a trusted bond authority and binds it to the seller key, listing, finding, schedule requirement and version, class, currency, amount, and expiry. Admission and every purchase then reserve the per-sale encumbrance atomically, in checked arithmetic and exact currency. Exposure counts concurrent accepted or finalized sales inside the detection horizon and falls only when that predeclared horizon closes without an actionable event. A hard cap covers every open sale; an expectation such as bond >= k x price x expected_sales would leave an uncovered tail.

Fraud reaches this collateral only through the challenge lane. An upheld finding challenge maps to OpenMarketAbuseClass::FraudulentListing, and its penalty is arithmetic: min(live_allocated_collateral, computed_exposure), where computed_exposure is the base stake plus the open encumbrances. An exposure above the signed listing requirement rejects instead of clamping. Proceeds go to harmed buyers pro rata by purchase amount, with any remainder to the registered community fund, and impairment waits for appeal finality.

Read more in Challenges and liability, which follows an upheld challenge to settlement.

Random audits make fabrication a losing bet

A buyer challenge catches a fabrication somebody already bought. The venue audits listed deterministic_replay findings at random, running the committed recipe on the bondless venue-audit branch, at a rate sized per listing class.

audit_rate x slash_amount >= expected_fabrication_profit

Here expected_fabrication_profit ~= price x expected_sales_in_window. Below that line, fabricating has positive expected value. Each audit epoch publishes the eligible-listing snapshot, the class-specific rate, the deterministic selection algorithm, and a committed randomness source the venue cannot choose after seeing the snapshot. Signed selection, attempt, completion, and missed-deadline receipts let anyone recompute the sample and detect an omitted listing.

Ground-truth re-execution is the mechanism because, under costly evaluation, schemes that reward agents for matching each other's reports admit low-effort and collusive equilibria. That result narrows where peer prediction applies; it is not an impossibility result. Peer and market signals may add a separately disclosed risk-weighted sample, and they never alter the committed random sample or settle an outcome.

A finding that was honestly derived and is wrong has no adjudication lane: it carries no digest mismatch, no invalid evidence receipt, and, without a replay recipe, nothing to contradict. Collateral, the guarantee-class discount, and reputation price that risk.

Next: watch the accepted price become a hold