Cognition Market Threat Model
See who can attack a finding sale, which control answers each attack, and which risks the market prices instead.
On this page
A seller may withhold a payload, a buyer may replay an old purchase, and a venue may present stale status. The threat model ties each attack on a finding sale to the asset it targets, the control that answers it, and the exposure left to the operator or the counterparty.
The model covers the single-operator market, its hosted profile, and cross-organization purchases settled through CrossOrgEscrow under a pinned settlement profile. Its examples follow the repair sale in The Cognition Market.
Five adversaries meet one trusted operator
A sale crosses one configured trusted operator, whose kernel mediates the reveal. Evidence verification and delivery checks depend on authenticated sources, and the operator itself remains a trust assumption.
A seller meets evidence facets, a committed digest, and live collateral
Fabricated evidence (S1) fails the evidence verifier's required facets. A swapped payload (S3) fails the committed digest before capture. A stale or retracted finding (S4) fails expiry, the status proof, or the durable floor. Reused collateral (S8) fails atomic encumbrance, and a hidden proof-profile upgrade (S9) is rejected at admission. Honest-cost fabrication (S2) is priced. Finding status.
- Seller. Wants payment for worthless, fabricated, stale, or stolen findings.
- Buyer. Wants the finding without paying, or wants to damage sellers.
- Colluding ring. Seller and buyer pairs, seller and challenger pairs, or sybil clusters gaming reputation, adjudication, and price signals. C1 covers the sybil case.
- Market operator. Rational-but-greedy or compromised: front-running, leaking, censoring, equivocating. O1 covers an operator acting with a seller.
- Observer. An outside party mining listings, receipts, and lineage for competitive intelligence.
For the repair sale, three answers stay separate: whether the delivered patch matches its commitment, whether its evidence supports the claim, and whether the operator is trusted to mediate the exchange.
Eight assets set what a sale must protect
The register names eight assets, A1 through A8. Two open residuals, S2 and X2, each reach more than one of them.
- A1, finding content. The sealed payload: confidentiality until the paid reveal, integrity against substitution.
- A2, buyer funds. No capture without a kernel-attested reveal of the finding's committed digest. An Allow proves the kernel accepted the preimage; whether the buyer received or retained the bytes is a separate fact.
- A3, seller bond. No slash without a predeclared, evidence-gated rule.
- A4, market truthfulness. Listings, evidence bundles, and status feeds mean what they claim.
- A5, buyer memory and state. Purchased content stays within what the buying agent's ingestion policy allows into its memory.
- A6, reputation capital. Scorecards and tiers cost at least as much to inflate as honest behavior.
- A7, encumbered collateral and fee pools. One live bond allocation backs one listing or challenge, finalized fraud exposure stays within remaining slashable collateral, and participation or dispute fees are spent only after they are collected.
- A8, financial terminal state. Every failure, timeout, mismatch, appeal, release, refund, compensation, and restitution path is signed, replay-stable, and bound to the same purchase and payment evidence.
The market adds five trust roles and no new cryptography
The roles sit on top of three inherited assumptions: the kernel is the trusted computing base, the audited assumption registry holds, and guarantee levels and evidence classes are truthful or the record is rejected.
- T1, the mediating kernel. Sees revealed content, as a designed-in trusted third party.
- T2, the finding-status feed operator. Trusted for the liveness and completeness of voluntary and cross-operator retractions. Root authenticity, equivocation, and staleness stay checkable through signatures, freshness windows, and anchoring; a fresh root still shows only the intents it includes.
- T3, the adjudication roster. Decides disputes a mechanical check cannot settle. Digest mismatch, evidence re-verification, and deterministic replay narrow what it decides.
- T4, the crypto-context signer. Reserved: it decides nothing under
chio.finding.v1. - T5, the challenge settlement operator. Derives and enforces the harmed-party destination allowlist from frozen purchase records. Its signed enforcement authorization makes the decision attributable and replay-stable; the bond-vault contract checks only distribution shape, beneficiary count, amount bounds, and exact-sum shares.
Chio builds a signature from the exact output preimage, so the kernel that mediates a read_finding call observes the plaintext it signs a receipt for. Within one operator that is the existing trust model, whose BoundaryClass vocabulary T1 borrows. Across organizations, the mediating operator learns the findings it delivers. A separately qualified measured-runtime deployment narrows who else sees the plaintext while the kernel still sees it; select the accepted measurements, quote verification, and key provisioning for the platform first, as the confidential node deployment guide describes.
chio.finding.v1 defines no canonical predicate carrier and binds no capsule or report digest, so admission treats descriptor fields such as outcome_class as public assertions backed only by the declared evidence class, and the buyer proof boundary rejects hidden range predicates. A hidden-predicate claim is admissible only under a schema version that binds the canonical predicate and capsule digest, pins the signer and proof profile, and has the buyer verifier resolve and validate that exact proof without upgrading its guarantee.
Each attack a sale turns on meets a named control
The catalog runs S1 to S9 on the seller side, B1 to B5 on the buyer side, C1 to C4 for collusion and sybils, O1 to O5 at the operator, and X1 and X2 for observers. These are the rows a single finding sale turns on.
| ID | Attack | Control |
|---|---|---|
S1 | Fabricated evidence bundle | Verify every required evidence facet |
S2 | Honest-cost fabrication | Bond, guarantee-class discount, reputation |
S3 | Bait-and-switch payload | Check the committed digest before capture |
S4 | Stale or retracted finding | Expiry, status proof, durable floor |
S8 | Reused or undercollateralized bond | Reserve live collateral at activation |
S9 | Unsupported proof-profile upgrade | Reject the upgrade at admission |
S7 / O5 | Non-delivery or attest-and-withhold | One hold terminal per purchase; neutral mediator |
B1 | Take the reveal, refuse payment | Hold the price before reveal dispatch |
B2 | Resale or republication | Provenance, license terms, leakage pricing |
B3 | Probing without purchase | Bounded disclosures, leakage accounting |
C1 | Wash trading for reputation | Count finalized, integrity-gated receipts |
O1 | Front-running by the mediator | Trusted operator or measured runtime |
X2 | Evidence-metadata side channel | Bucketed public evidence |
Integrity checking covers the finding itself. verify_finding proves that a finding is structurally strict, content-addressed to its own digest, and signed by the inline issuer; evidence, liveness, bond and status references, reveal delivery, settlement, and challenges each have their own check. A listing advertised as verified requires an explicit FindingEvidenceVerifier profile, which returns a facet report with distinct integrity, evidence, metered-exposure, settled-spend, intent, collateral, and liveness results. A missing facet fails the policy that requires it and is never silently upgraded.
Three controls carry most of a sale. Matching bytes against the committed reveal digest establishes delivery integrity, while the repair's usefulness rests on its claim and evidence. Verifying status against the retained epoch floor keeps a validly signed lower epoch from displacing an accepted higher one, with retraction timing and operator omission still in play. Terms and pricing account for copying after the sale, because the reveal protocol cannot make purchased knowledge uncopyable.
Read more in Attack catalog entries, which give each row's mechanism and remaining exposure.
Bonds, decay, and bucketing price the open residuals
Honest-cost fabrication (S2), resale after reveal (B2), and the evidence-metadata side channel (X2) have no mechanical closure. A bond, a decay curve, and bucketed disclosure allocate their costs in the market instead.
The residual-risk register ranks every residual with its instance and severity, and its rows carry production severity for a finding sale. Rated high: fabricated evidence accepted without the evidence verifier, honest-cost fabrication of metered_attested nulls, post-reveal resale, listing collateral reused or outrun by exposure, and paid non-delivery under a seller-aligned cross-organization mediator, the topology the settlement profile rejects.
The market inherits the kernel's settlement invariants and weakens none of them. Inherited invariants lists the five that its mitigations leave unchanged.
Attack catalog entries
Search for S4, collateral, or evidence_cost.
S1, fabricated evidence bundle
The evidence verifier re-verifies receipt bodies and signatures, checkpoint inclusion, trusted-kernel and revocation state, receipt attribution, the separate issuer-signed seller authorization, guarantee class, and liveness, fail-closed. An enforced fraud outcome maps to the frozen v1 FraudulentListing class and carries exactly one External reference to the signed chio.finding.challenge-outcome.v1.
Remaining exposure. Audited trust in the kernel, the checkpoint and issuer key set, and the evidence resolver.
S2, honest-cost fabrication
Metering establishes that compute was spent on a metered_attested finding; whether that compute produced a relevant result is a separate question. The market allocates the residual to the bond, the guarantee-class discount, and reputation, and claims no proof.
Remaining exposure. Honest-cost fabrication stays open for metered_attested findings.
S3, bait-and-switch payload
The delivery contract refuses an Allow receipt unless the final output hash equals its token constraint, and admission selects exactly one grant with exactly one OutputDigestSha256 value, persisted across restart. A mismatch persists a signed Deny carrying the expected and observed digests and releases the reservation and hold exactly once. It cannot Allow or capture, so it is neither a refund nor a compensation.
Remaining exposure. Delivery integrity says nothing about the finding's usefulness.
S4, selling a stale or retracted finding
The finding's own expiry applies, plus a registered portable non-inclusion proof the kernel verifies against the signed epoch, feed, nonce, finding, path, and freshness before the reveal. The verifier also retains a latest-observed (map_epoch, epoch_id, root_hash) floor, so a lower-epoch valid proof and an equal-epoch proof with a different root both reject inside the nominal freshness window.
Remaining exposure. Retraction between proof and reveal, bounded by the window, plus selective omission under O2.
S8, reused or undercollateralized listing bond
A signed requirement or an opaque bond_ref is a reference, and collateral is a live encumbrance. Activation atomically creates one bound to seller, listing, finding, requirement class, currency, amount, and expiry, and rejects stale, wrong-party, wrong-currency, and already-allocated collateral. Concurrent admission caps open encumbrances against remaining slashable value.
Remaining exposure. The chosen coverage horizons and multiplier can understate tail risk, which is disclosed instead of being called fully bonded.
S9, unsupported proof-profile upgrade
A seller labels an outcome_class or a disclosure capsule as a hidden verified predicate the finding commits to no digest for. Admission rejects every such upgrade and reports only the facet it can verify.
Remaining exposure. None: this profile offers no hidden verified claim.
S7 and O5, non-delivery or attest-and-withhold
Within one operator, the purchase chain reaches exactly one rail-hold terminal per crash or retry: exact-once release before capture on any Deny, or exact-once capture after a durably staged matched Allow. Across organizations, a seller-aligned mediator could accept a genuine request, sign and checkpoint the Allow, suppress the response, and release escrow. The settlement profile rejects that topology and requires a neutral or mutually trusted mediator drawn from the escrow allowlist.
Remaining exposure. High under a seller-aligned cross-organization mediator, which is why that topology is rejected.
B1, take the reveal and refuse payment
Ordering alone does not carry this one. The provider AskResponse mints the read_finding grant first, and the authoritative budget and exposure reservation lands before accept(); neither step authorizes or captures the reveal price. The no-loss property comes at reveal time: after guards pass and before dispatch, the kernel authorizes the quoted price as a reversible Held payment, and captures only after the digest and media-type checks.
Remaining exposure. Payment relies on the configured local adapter and the kernel checks.
B2, resale or republication after reveal
Information is copyable, so cryptography leaves this open. The responses are economic and forensic: provenance identifies the original producer, listing terms can declare license scope enforced outside the protocol, and pricing assumes post-sale leakage.
Remaining exposure. Purchased information can be copied or republished.
B3, probing without purchase
The pre-purchase descriptor is a deliberate fixed leak: topic, context digest, and outcome class. Anything richer goes through disclosure capsules with per-field leakage budgets and derived-inference ledger entries.
Remaining exposure. Medium: descriptor metadata itself carries signal, so sellers choose topic granularity accordingly.
C1, wash trading to inflate reputation
Only finalized, integrity-gated purchase and fee receipts count toward reputation, and the top tier requires two distinct evidence feeds. Wash volume shows as self-referential lineage through delegation_depth and root_budget_holder on the financial metadata.
Remaining exposure. A patient adversary can still buy reputation at the collected fee and trade cost.
O1, front-running or leakage by the mediating operator
T1 in attack form: an operator positioned to mediate a reveal is positioned to act on it first. Receipts and lineage make operator-side republication attributable; attribution identifies a front-runner after the fact.
Remaining exposure. Material for cross-organization purchases through an untrusted operator, so confidentiality-critical buyers keep those purchases inside a trusted-operator or measured-runtime boundary.
X2, evidence-metadata side channel
Public evidence about a sale leaks content: a tiny evidence_cost or a short receipt chain reads as a result that failed immediately. Public descriptors carry bucketed evidence_cost, with exact values only inside the paid reveal, coarse timestamps, and leakage-ledger accounting for every descriptor field.
Full evidence receipts re-leak exact costs through their financial metadata, so bucketing without projection defeats itself, and a seller chooses per listing between full-receipt and BBS-projected evidence modes. A projection authenticates its own disclosed statement and cannot claim the concealed originals' receipt-authenticity, checkpoint-membership, or cost-backing facets.
Remaining exposure. A listing's existence is one bit no bucketing scheme hides. Listing search exposes descriptor and pricing data, and query linkage and count leakage stay visible, so the market makes no one-bit privacy or pricing claim.
Residual-risk register
| Risk | Instance | Severity |
|---|---|---|
Fabricated evidence accepted without the evidence verifier (S1) | Both | High |
Honest-cost fabrication of metered_ nulls (S2) | R&D | High |
Post-reveal resale or leakage (B2) | Both | High by nature |
Operator sees revealed content across organizations (O1 and T1) | Both | Medium-high |
Listing collateral reused or outrun by exposure without admission (S8) | Both | High |
Reputation purchasable at collected fee and trade cost (C1) | Both | Medium |
No revenue clawback in v1 | Both | Medium |
Paid non-delivery under a seller-aligned cross- | Cross-org | High |
Inherited invariants
- Invariant 9, slash proceeds. A fabrication slash never pays insiders: the operator, the mediator, and any party positioned to have caused the fabrication are excluded.
- Invariant 10, no discretionary settlement. A dispute resolves through a mechanical check or the T3 roster, and an operator's judgment substitutes for neither.
- P1, capability attenuation. A purchase capability is a narrow single-use grant:
max_invocations: 1, both cost ceilings set to the price, exactly one digest constraint, and exactly one purchase marker. - P4, receipt integrity. A sale's delivery receipt is exactly as tamper-evident as any other governed call's receipt.
- P10, evidence-class truthfulness. An evidence class is never upgraded, which keeps an
assertedfinding from passing as verified. The same discipline governs the claim registry over Chio's own proofs.
Source
The model, its asset register, and its full catalog follow docs/market/THREAT-MODEL.md in the Chio repository.