> ## Documentation Index
> Fetch the complete documentation index at: https://docs.intention.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust assumptions

> What is left to trust once everything checkable has been checked — the validator set, the price quorum, governance, the bridge, and the software itself.

Every trading venue claims to have removed trust, and almost none says what it left behind. That makes the claim unfalsifiable, which is the same thing as making it worthless. This page is the list.

It is written as bounds rather than mitigations. A mitigation answers *what are you doing about it*; a bound answers *how bad can it get*, and only the second is something a reader can check. Where a surface has no bound yet, the entry says so.

<div className="dg" data-dg="trust-surfaces">
  <div className="dg-c" style={{aspectRatio:"720 / 434"}}>
    <svg className="dg-w" viewBox="0 0 720 434" aria-hidden="true" />

    <div className="dg-b dg--blue dg-left" style={{left:"0.0000%",top:"6.9124%",width:"59.7222%",height:"14.2857%"}}><span className="dg-t">Consensus</span><span className="dg-s">Byzantine stake stays under one third</span></div>
    <div className="dg-b dg-plain dg-left" style={{left:"63.6111%",top:"6.9124%",width:"36.3889%",height:"14.2857%"}}><span className="dg-s">Under the threshold, no minority can withhold a batch or commit a second ordering. Over it, the safety argument stops.</span></div>
    <div className="dg-b dg--sky dg-left" style={{left:"0.0000%",top:"23.5023%",width:"59.7222%",height:"14.2857%"}}><span className="dg-t">Price</span><span className="dg-s">A quorum certifies the observation, not its accuracy</span></div>
    <div className="dg-b dg-plain dg-left" style={{left:"63.6111%",top:"23.5023%",width:"36.3889%",height:"14.2857%"}}><span className="dg-s">Clamping and venue diversity bound how far one source moves the result. Neither supplies information the market did not have.</span></div>
    <div className="dg-b dg--yellow dg-left" style={{left:"0.0000%",top:"40.0922%",width:"59.7222%",height:"14.2857%"}}><span className="dg-t">Governance</span><span className="dg-s">Reconfiguration at epoch boundaries</span></div>
    <div className="dg-b dg-plain dg-left" style={{left:"63.6111%",top:"40.0922%",width:"36.3889%",height:"14.2857%"}}><span className="dg-s">Bounded to the validator set, consensus and risk parameters, and emergency actions. Who holds the authority is not yet published.</span></div>
    <div className="dg-b dg--orange dg-left" style={{left:"0.0000%",top:"56.6820%",width:"59.7222%",height:"14.2857%"}}><span className="dg-t">Bridge</span><span className="dg-s">Escrow contracts and a validator-attested message channel</span></div>
    <div className="dg-b dg-plain dg-left" style={{left:"63.6111%",top:"56.6820%",width:"36.3889%",height:"14.2857%"}}><span className="dg-s">Withdrawal rate limits bound the blast radius. Deep source-chain reorgs and signing-key compromise are not bounded by them.</span></div>
    <div className="dg-b dg-left" style={{left:"0.0000%",top:"73.2719%",width:"59.7222%",height:"14.2857%"}}><span className="dg-t">Software</span><span className="dg-s">One third-party audit in scope; the rest under internal control</span></div>
    <div className="dg-b dg-plain dg-left" style={{left:"63.6111%",top:"73.2719%",width:"36.3889%",height:"14.2857%"}}><span className="dg-s">Replay proves nodes agree with each other. It does not prove the specification was implemented twice and agreed.</span></div>
    <div className="dg-free" style={{left:"0.0000%",top:"0.0000%",width:"59.7222%"}}><div className="dg-n">What you still have to assume</div></div>
    <div className="dg-free" style={{left:"63.6111%",top:"0.0000%",width:"36.3889%"}}><div className="dg-n">What bounds it</div></div>
    <div className="dg-free" style={{left:"0.0000%",top:"90.3226%",width:"100.0000%"}}><div className="dg-n">Verification bounds what has to be assumed. It does not empty this list, and no protocol empties it.</div></div>
  </div>
</div>

## Consensus

**The assumption:** Byzantine stake stays under one third of the total.

[IntentionBFT](/protocol/architecture/intention-bft) tolerates an adversary controlling up to a third of stake. Honest stake is therefore always more than two thirds, and the quorum for anything is a set of validators whose combined stake exceeds two thirds. Safety holds unconditionally under that threshold; liveness holds after the network stabilizes.

**What the bound gets you.** Two specific things, not a general feeling of safety. Transaction batches must prove two-thirds stake-weighted availability before a proposal may reference them, so a block can never depend on data a Byzantine minority alone was holding. And the ordering is a consensus-committed object covered by the block hash, so no honest validator will have signed a second ordering of the same transactions in the same round.

**What it does not get you.** Over the threshold, the argument does not degrade gracefully — it stops. And under it, one surface remains open: a leader chooses which available batches to include in its own proposal and how to arrange them. That is named as a residual surface on the consensus page, mitigated by leader reputation and by the fact that a leader cannot produce a block at all without valid price observations. Stronger fair-ordering constructions are tracked as a candidate upgrade rather than shipped.

## Price

**The assumption:** a quorum certifies that these observations were submitted at this round. It does not certify that they were right.

The distinction is the whole of it. The [oracle](/protocol/architecture/oracle) page states the guarantee precisely: a transaction settled against a price a validator quorum certified at the round that committed the transaction, and no execution path could have read a different one. Binding price to transaction is a real property, and it is not the same property as the price being correct.

**What bounds it.** Aggregation clamps how far any single source can move the result, and a venue-diversity requirement means observations for an instrument are drawn from more than one independent source. Mark price is smoothed and bounded off the index, so a brief dislocation does not cascade straight into liquidations.

**What it does not bound.** A coordinated move across several of the underlying venues, or a market-wide dislocation. Weighting and clamping cannot manufacture information the market did not have. Price is the trading system's most consequential external input, and manipulation resistance here is a matter of degree.

## Governance

**The assumption:** a reconfiguration authority exists, and at epoch boundaries it can change things you are relying on.

Within an epoch the validator set and most parameters are constant. At an epoch boundary a governance-authorized reconfiguration may change the validator set, consensus parameters, risk parameters, and may take emergency actions. Transitions are atomic — every honest validator sees the same transition at the same block height — but atomicity is a property of *how* the change lands, not a limit on *what* may change.

The reach is real and worth stating plainly. Market listing, fee configuration, leverage tiers, and risk parameters are all system-configuration instructions authorized by governance, and the margin tiers that determine your liquidation price move within governance-set bounds.

<Warning>
  Who holds that authority, by what process, and with what notice period is not yet published on this site. Until it is, this is the largest unbounded surface on the page, and it should be read that way rather than as an omission implying nothing is there.
</Warning>

## Bridge

**The assumption:** the escrow contracts on external chains, and the validator-attested message channel between them and this one, both hold.

Collateral enters through the [bridge](/protocol/architecture/bridge). The contracts on the source chain hold escrowed assets; a successful exploit of those contracts, or of the attestation channel, results in a loss of bridged collateral. This is structurally the most exposed component in the system, because it is the only one whose security depends on software the protocol does not execute.

**What bounds it.** Withdrawals are rate-limited, which bounds the blast radius of an exploit that is discovered rather than one that is not. The bridge is the highest-priority area for internal review and is in scope for the [bug bounty](/protocol/security/bug-bounty).

**What the rate limit does not bound.** Source-chain reorgs deeper than the configured confirmation depth, validator signing-key compromise, and defects in the attestation logic itself.

## Software

**The assumption:** the specification is implemented correctly, and the specification is right.

[Verification](/developers/verify) establishes that the state you are served was produced by the published rules on committed inputs. It cannot establish that those rules are free of defects — reproducing a bug exactly is still reproducing it. That is what [audits](/protocol/security/audits) and the [bug bounty](/protocol/security/bug-bounty) exist for, and the audits page is explicit that one third-party audit is currently in scope while the kernel, consensus, and Clearinghouse are covered by internal controls rather than external review.

One consequence deserves naming because it is easy to overclaim. Byte-determinism becomes a *cross-check* only when more than one implementation exists. Until a second independent client is running in production, replaying a block confirms that nodes agree with each other — not that the specification was implemented twice, independently, and agreed.

## Where this leaves you

The honest summary is not that trust has been removed. It is that it has been moved from places where you have to take someone's word — an operator's margin figures, a risk committee's timing, a report assembled beside the system — into places where the assumption can at least be named, bounded, and watched.

The list above is what remains. It shrinks as clients diversify, as audits complete, and as governance is documented; it does not reach zero, and a venue telling you it has is telling you something about its documentation rather than its architecture.

## Where to go next

<CardGroup cols={2}>
  <Card title="Verify it yourself" href="/developers/verify">
    The five checks that shrink this list.
  </Card>

  <Card title="IntentionBFT" href="/protocol/architecture/intention-bft">
    The fault threshold, quorums, and what a leader can still choose.
  </Card>

  <Card title="Oracle" href="/protocol/architecture/oracle">
    What certification guarantees, stated precisely.
  </Card>

  <Card title="Risks" href="/protocol/security/risks">
    The same ground from a trader's side rather than an architect's.
  </Card>
</CardGroup>