Risks

Oracle manipulation

Terms that read market data can be pushed by anyone with capital. A payee who is paid on market cap has a reason to inflate it.

Arrha's market Terms use three layers:

• 30 min TWAP. One block, or one minute, of an inflated price barely moves the average.
• Hold time. The threshold must hold for the full period, typically 24 h. Sustaining a fake price for a day costs real capital and invites arbitrage.
• Minimum liquidity. A high price on a thin pool does not count.

These raise the cost of manipulation. They do not remove it. Set thresholds and holds in proportion to the size of the deal.

Observation sampling

Hold timers and Clock pauses are sampled at observations: deal creation, each settle and claim, and any observe call. A dip below the threshold between two observations is not seen unless someone observes during it. The TWAP smooths short dips. A payer who wants strict continuity can call observe regularly, or run a keeper that does.

Payer griefing

A payer might accept the work and refuse to pay.

• Metric mode. The payer has no say. If the Term is true, anyone can settle.
• Handshake mode. The payer can reject, but must pay the kill fee. If the payer goes silent, the payee is paid after 72 h.
• Cancel. The payer can cancel only before the payee accepts. After acceptance the earnest is committed.

Payee griefing

A payee might accept a deal to block it and then do nothing.

• Bond. A payer can require a payee bond. A payee who never delivers loses it to the payer.
• Deadline. Every deal has a deadline. After it, an unmet deal refunds.
• Handshake. A payee who marks delivered without delivering can only win if the payer stays silent for 72 h. A rejection costs the payer the kill fee only.

Bounty front-running

A bounty pays whoever calls claim first once the Term is true. Claims are public before they are mined. The person who caused the result may not be the one who is paid. Use a named payee when that matters.

Deadline edge cases

• Strictly after. A deal is past its deadline only when the block timestamp is greater than the deadline. At the exact deadline second, the deal is still running.
• Settle at call time. settle reads the Term when it is called. A Term that becomes true after the deadline still pays, unless someone settled a refund first. A Term that was true before the deadline but reads false when settle is called after it refunds. Payees should settle as soon as their Term is true.
• Clock remainder. At the deadline, a Clock tranche releases what has vested and refunds the rest. Set the deadline after the vesting end, with room for pauses.
• Handshake delivery. markDelivered must happen before the deadline. The 72 h review window may run past it.
• Unaccepted deals. An Open deal past its deadline refunds in full and ends Expired.

Custom Terms

A custom Term can be written to return true at any time, or never. See Trust model.

Contract risk

The contracts are an unaudited testnet build. Bugs may exist. Do not lock value you cannot lose.

Chain risk

Arrha depends on Elysium's sequencer, RPC and finality. Settlement timing depends on block timestamps set by the sequencer. Deadlines and windows are hours and days long, so small timestamp drift does not matter in practice.