Every mechanism stress-tested under coordinated attack. We simulated fake-identity floods, large-holder takeovers, coordinated-group strikes, instant-borrow exploits, vote takeovers, hub failures, mass migration. Fifty-two scenarios — all of them models, not history.
15 of 15 shown
Every number and every outcome on this page is simulation output. These are adversarial models of a protocol no community is running yet — read them as engineering, not as history.
600 fake-identity accounts injected into Lagos at week 20. The protocol requires humans-only verification before any account can receive the weekly dignity payment, and tier advancement counts unique people actually served — not transaction counts. Result: no tier inflation, federation Gini 0.640, all 18 gates green.
500,000 CP is placed in one Berlin member's hands at week 20 — far above any holding the baseline run produces — and the run asks whether a concentration of earned holdings can capture the vote. Capital cannot enter at all: the circuit is closed, so there is nothing to buy and no way to buy a position. Voting cost grows as the square of votes cast, reputation weight is capped at 1.5×, total influence at 2.5×, and newly earned CP is vote-locked for 7 days. Max governance concentration 11.2%, all 18 gates green.
Five attackers per hub × three hubs coordinating votes through mutual delegation. The protocol's 50% decay per delegation hop exposes the chain. Result: governance concentration 22.6%, well below the 40% gate.
1M-CP position opened at week 30 · 7-day voting lock on new CP · attacker removed week 31 → governance unaffected at 11.4%, Gini 0.640.
Five fake Trustees with 200K CP each injected at week 15. The wisdom ceiling (extra voting weight from experience caps at 2.5×) and supermajority thresholds blocked the attempt. Max governance concentration 11.5%.
Symmetry ≥0.7 across 3+ reciprocal trades · DFS ring detection (depth 5) → −20 reputation, make-whole of the CP minted on the flagged volume, 13-week flag, tier advancement frozen. 202 accounts flagged across the seven hubs.
50% of high-skill creators reject UBD in Berlin at week 25 · mandatory acceptance for basics + health-factor adjustment → ecosystem stabilizes at 21.8% creator ratio.
ArtistNet derecognized at week 30 → 765 refugees, 100% of them placed, 100 gCP grant each, 70% reputation transferred, no cascade (6 of 7 hubs still standing).
A coalition tries to mint 9.9B gCP beyond the 10B cap at week 25. The unamendable supply ceiling blocks the mint at the engine level. One violation logged, cap intact.
Fake identities + large-holder takeover + coordinated 2-hub strike + recession + trust collapse + instant-borrow exploit + hub failure — all interleaved across 52 weeks. Result: 6 of 7 hubs survive, 795 refugees placed, all 18 gates green.
26-week run across 50 hubs and 276,700 members. Hubs above 5,000 members use sampled per-member operations, scaled by the inverse sample fraction so the cohort mean is preserved. All 18 gates pass at that scale — the engine is statistically scale-invariant.
13-week agent-based run with 526,000 simulated humans across 100 hubs. Largest run in the suite. All 18 gates green; baseline behaviour identical to small-hub runs (scale invariance confirmed).
Closed-form macro model — not one of the 52 published runs: 5,000 hubs × 1.6M members = 8 billion humans. Its 7 constitutional invariants hold: gCP supply sufficient (1.25 gCP per human), price inside the 0.50–2.00 Đ̄ band, hub allocation positive with the release pool unexhausted, CP cap scaling with population, and the 10B gCP cap unamendable.
520-week run with 7%/yr generational turnover: 6,401 deaths, 238 successor inheritances under the 80/20 succession rule. 27 sustained coordinated-group attempts, none of which pushed a hub past the 30% governance-concentration audit threshold. Y4 involuntary exit (438 members forced from Berlin under refugee-class protection), Y6 labour displacement (948 Power → Casual), Y8 climate cascade (one hub into CRITICAL). 1,069 refugees placed, all of them. All eighteen gates hold: provisioning depth ends at 1.23×/yr, above the 1.00 floor, and hub survival holds with 1 of 7 hubs lost within the allowance of 1.
Decade-Hardening stress test — a nation-state attempts five attack vectors: a forced ID-collection mandate, a demand to export the identity registry, an asset freeze on 50 members, an attempt to install an admin override key, and a retaliation order against members who left. The engine logs 54 attempts and blocks every one at the protocol layer. gCP cap intact. All 18 gates green.
If the engineering convinces you, this is the argument it was engineered to serve.
Read the protocolFifty-two scenarios. Baseline operation through coordinated attack, hub failures, mass migration, planet-scale runs, and a ten-year continuous stress test. Every result published — every one of the fifty-two clears every gate. Every input open for anyone to re-run.
| Scenario | Creator % | Max Gini | gCP Đ̄ | Gov Conc. | Hubs A/F | Status |
|---|---|---|---|---|---|---|
| Baseline (52w) | 22.0% | 0.640 | 0.81 Đ̄ | 11.6% | 7/0 | Healthy |
| Fake-Identity Attack | 21.5% | 0.640 | 0.81 Đ̄ | 11.5% | 7/0 | Healthy |
| Large-Holder Takeover | 21.9% | 0.612 | 0.81 Đ̄ | 11.2% | 7/0 | Healthy |
| 3-Hub Coordinated Attack | 21.4% | 0.608 | 0.81 Đ̄ | 22.6% | 7/0 | Caution |
| Wash Trading | 22.0% | 0.640 | 0.81 Đ̄ | 11.5% | 7/0 | Healthy |
| Instant-Borrow Exploit | 22.0% | 0.640 | 0.81 Đ̄ | 11.4% | 7/0 | Healthy |
| Vote Takeover | 21.6% | 0.612 | 0.81 Đ̄ | 11.5% | 7/0 | Caution |
| Trust-Collapse Spiral | 21.8% | 0.645 | 0.81 Đ̄ | 11.5% | 7/0 | Healthy |
| Recession | 22.0% | 0.644 | 0.81 Đ̄ | 11.3% | 7/0 | Healthy |
| Mass Migration (30%) | 21.9% | 0.634 | 0.81 Đ̄ | 11.5% | 7/0 | Healthy |
| Hub Failure | 21.4% | 0.647 | 0.81 Đ̄ | 11.1% | 6/1 | Healthy |
| Refugee Crisis (2 hubs) | 19.2% | 0.642 | 0.81 Đ̄ | 11.1% | 5/2 | Caution |
| Federation Cap-Breach | 22.0% | 0.640 | 0.81 Đ̄ | 11.6% | 7/0 | Healthy |
| Stress (all attacks) | 20.0% | 0.608 | 0.81 Đ̄ | 15.7% | 6/1 | Caution |
| Genesis (forming hubs) | 22.6% | 0.605 | 0.81 Đ̄ | 10.1% | 1/2 | Healthy |
| Long-Term (3 years) | 33.0% | 0.637 | 0.81 Đ̄ | 11.1% | 7/0 | Healthy |
| Scale Test (25 hubs · 50K) | 18.0% | 0.641 | 0.81 Đ̄ | 11.8% | 25/0 | Healthy |
| Mega Scale (50 hubs · 250K) | 12.8% | 0.584 | 0.81 Đ̄ | 13.9% | 50/0 | Healthy |
| Planet Scale (100 hubs · 500K) | 12.5% | 0.550 | 0.81 Đ̄ | 20.4% | 100/0 | Healthy |
| Decade Long (10yr · gen turnover) | 49.7% | 0.616 | 0.81 Đ̄ | 25.4% | 6/1 | Caution |
| State Seizure | 22.0% | 0.640 | 0.81 Đ̄ | 11.6% | 7/0 | Healthy |
Every metric on this page is model output, self-imposed and disclosed — and no figure implies an exchange rate, because there is none.
Provisioning depth — how to read the Status column (v5.10). v5.5 replaced reserve coverage with provisioning depth: a different numerator, not a renamed one — coverage measured a reserve balance against circulating value, depth measures purchasable real value against active circulation. v5.10 then corrected the arithmetic, annualising the quarterly numerator so that the reading and the band that judges it are stated in the same unit — × per year. The full 52-scenario suite has been re-run end to end against the corrected metric. The Status column is per-row measured data, not a verdict: it names the band each scenario's own depth falls into — Healthy ≥ 2.0 ×/yr · Caution 1.0–2.0 ×/yr · Thin below 1.0 ×/yr, the §5.6 floor and the §7.8 intervention line. Read every one of them as a lower bound. Each scenario runs at the engine's default donation rate of zero, because §15.2 fixes the valve's direction but fixes no magnitude — donations are voluntary, so none is assumed. What a row reports is therefore production only: the hubs' own registered goods and committed labour, with nothing donated behind them. Where a reading sits low, §5.6 already names the two remedies — register more provisioning, or mint less. Full scenario-by-scenario figures are published in the whitepaper (§23.6). Prices read in Đ̄, the federation dignity unit: the closed circuit re-denominates every protocol price at 1:1, and no figure here implies an exchange rate against external money — there is none.
The code is good. But bugs exist, platforms evolve, and code-as-law does not mean code-frozen-forever. Engine changes are constitutional acts: they take the amendment path of the clause they enforce, with publication, delay, independent verification, and weekly state snapshots anyone can verify.
A change to enforcement bytecode is classified as an amendment of the clause it enforces, and takes that clause's amendment path: ordinary changes under §7.1 (90% of the Federation Council, after a 26-week discussion), changes touching Article I under §7.2 (95% of the Council plus ratification by 80% of individual hub votes), and no path at all where §7.3 applies — the rights core cannot be amended at any threshold. The ultimate check is the record itself: full state snapshots published weekly, sufficient for any member, hub or auditor to verify the Federation's state without the incumbent's cooperation.
Deployment authority is a threshold key held by Trustees across at least seven jurisdictions on at least four continents, with a two-thirds threshold. No single hub, jurisdiction, or foundation can deploy. The key cannot freeze, seize, or reassign any holding; its only permitted action is to execute an amendment already ratified.
Every proposed change is published as source and as reproducible build artefact for the full discussion period. Changes touching any calibration or any §7.3 provision require two independent audits, published in full, and a formal proof of the specific invariant claimed. The implementation delay runs from publication of the build, not from the vote.
A passing suite protects only against the class of attacks already imagined. A continuous red-team programme moves the narrative from static ('passed') to dynamic ('we keep verifying'). Four channels — two in Phase 1, two in Phase 2.
A 4–6 person team, independent from the development team, funded from the Protocol Development pool (§7.2 — 500M gCP, vested over ten years; no Foundation ever holds gCP). Reports directly to the federation, not to management. Its share auto-vests outside milestone acceptance (§7.2.1) — no one who signs builder milestones can starve it. At genesis the jurisdiction's accredited Foundation signs pool milestones administratively, by default and never by right, published on-chain and reviewable by the first Arbitral Panel ever formed. Until the team stands up, the adversarial record is the suite itself — re-run on every amendment, with the failures published — and the translation process, which keeps finding what English review missed.
$5K to $500K depending on severity — paid in cash by an accredited Foundation out of donations (Article XV), never from a token sale and never in tokens. Explicit legal safe-harbour. Coordinated disclosure with a 90-day window before publication.
Trail of Bits / IC3 / Imperial Centre for Cryptocurrency Research. 12–18 months per iteration, full public report, no NDA on findings.
All simulation code published with a reproducible tag. Anyone can re-run all 52 scenarios, propose new ones, or contest results.