mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
b55171116e
Retract the fabricated '581M/597ns / 100M+/s / 434M GPU / planet-scale' headline (a time.Sleep sim + x40 fudge that measured nothing) across the corpus. Flagship lux-lightspeed-dex rewritten (decomplected d-chain engine / dexvm atomic proxy / Go wrapper / 0x9010 CLOB facade; measured GB10 104-126M & M4 Max ~250M fills/s byte-parity-gated; Knuth-D division lever; Block-STM settlement; P3Q->starkfri rollup to Z-Chain). Technical papers (precompile-engineering, gpu-crypto-stack, evmgpu-benchmark, p3q-corona, smart-order-routing, fhe-mpc-hybrid) carry the measured impl + cross-ref the flagship. >1B/s framed honestly as N-node aggregation, never single-GPU. All compile.
55 lines
3.3 KiB
TeX
55 lines
3.3 KiB
TeX
\section{Security}
|
|
\label{sec:security}
|
|
|
|
This section covers the security properties that follow from the architecture---value
|
|
conservation, consensus safety, and the bounded trust surface of the single-operator
|
|
venue---and the operational protections layered on top.
|
|
|
|
\subsection{Value conservation and consensus safety}
|
|
|
|
Two properties are structural rather than discretionary. \emph{Value conservation} follows
|
|
from atomic shared-memory import/export (Section~\ref{sec:cross-chain}): import and export
|
|
are applied in a single commit at block acceptance, so no path creates or destroys value,
|
|
and a block that is verified then rejected applies nothing. \emph{Consensus safety} follows
|
|
from the determinism discipline (Section~\ref{sec:determinism}): accepted state is a pure
|
|
function of the block, so all validators agree on the state root, and a proposer cannot
|
|
carry fabricated fills past a validator that re-derives them in \texttt{Verify}. Both are
|
|
exercised by tests---an end-to-end conservation test and same-block state-root equality
|
|
across fresh VMs---that fail on regression.
|
|
|
|
\subsection{Bounded trust surface of the single venue}
|
|
|
|
The D-Chain is a single-operator venue today. The residual trust this introduces is bounded
|
|
and named. A block the proposer builds and relays that then loses the consensus poll can
|
|
strand a D-Chain match with no settling counterpart; the blast radius is one taker's escrow,
|
|
and there is no supply inflation because conservation holds on every committed path. The
|
|
trustless rollup (Section~\ref{sec:rollup}) closes this surface by binding finality to a
|
|
verified validity proof rather than to proposer behavior, which is the security reason to
|
|
move from P3Q attestation to \texttt{starkfri} validity proofs as the venue decentralizes.
|
|
|
|
\subsection{Post-quantum verification}
|
|
|
|
The rollup verifiers are post-quantum. P3Q is FIPS-204 ML-DSA, and \texttt{starkfri} is a
|
|
STARK/FRI verifier over the Goldilocks field with a cSHAKE256 transcript---hash-based, with
|
|
no reliance on pairings or discrete-log hardness. Finality therefore does not rest on
|
|
assumptions broken by a quantum adversary, and the precompile envelope for \texttt{starkfri}
|
|
carries formal-verification artifacts for byte-level identity.
|
|
|
|
\subsection{Validator incentives and slashing}
|
|
|
|
Where the D-Chain decentralizes to multiple validators, the staking and slashing model
|
|
follows the Lux primary network: validators stake, earn a share of fees, and are slashed for
|
|
provable misbehavior. The relevant provable faults here are producing a block whose carried
|
|
fills or state root disagree with honest re-execution (a determinism violation), and
|
|
censorship of valid orders. Because the offense is detectable by deterministic
|
|
re-execution, slashing does not require a subjective judgment.
|
|
|
|
\subsection{Circuit breakers and oracle feeds}
|
|
|
|
Operational protections sit above the protocol. A volatility circuit breaker halts a market
|
|
when its price moves beyond a configured threshold within a window, resuming after a cooldown
|
|
or by governance action; the halt and resume are themselves consensus actions, so they apply
|
|
uniformly. Mark prices for liquidations and funding---where derivative markets are
|
|
enabled---are taken from decentralized oracle feeds with outlier rejection and on-chain
|
|
verification, rather than from a single source.
|