THORChain: a decentralised liquidity protocol

01 Claim ledger

What the paper is allowed to say

Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.

1. Claim 01 · Paper model

   The hard part is custody across chains

   An automated pool on one chain is a contract. A swap from native bitcoin to native ether needs a set of operators who hold those assets and can be punished. The paper is about that set.

2. Claim 02 · Paper model

   Pools use a constant-product style invariant

   Each pool pairs the network's own asset with an external asset. Swaps move along that curve. The pricing idea is familiar. The custody idea is not.

3. Claim 03 · Paper model

   Bonding is the security budget

   Nodes post a bond. The paper's argument is that the bond, and the income nodes earn, should make theft less attractive than honesty. If the pools outgrow the bonds, the argument weakens.

4. Claim 04 · Paper model

   Churn keeps the set fresh

   Membership rotates. A static multisig of founders is not the design. Whether the rotation is real is an operational fact.

5. Claim 05 · Paper model

   Observation of other chains is a consensus job

   Nodes must agree that a bitcoin transaction happened before they credit a pool. A failure of observation is a failure of the swap, even if the pool math is right.

02 Three cuts

Observation, model, falsifier

A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.

1. 01 The hard part is custody across chains

   Observation

   What the study says

   An automated pool on one chain is a contract. A swap from native bitcoin to native ether needs a set of operators who hold those assets and can be punished. The paper is about that set.

   Model

   What has to hold

   Bonded value remains large relative to pooled assets under the paper's security argument.

   Falsifier

   What would retire it

   What is bonded value relative to pooled value today, not in the paper's illustration?

2. 02 Pools use a constant-product style invariant

   Observation

   What the study says

   Each pool pairs the network's own asset with an external asset. Swaps move along that curve. The pricing idea is familiar. The custody idea is not.

   Model

   What has to hold

   Each external chain's confirmation rule is conservative enough for that chain's reorg behaviour.

   Falsifier

   What would retire it

   Which failures were implementation bugs rather than failures of the invariant?

3. 03 Bonding is the security budget

   Observation

   What the study says

   Nodes post a bond. The paper's argument is that the bond, and the income nodes earn, should make theft less attractive than honesty. If the pools outgrow the bonds, the argument weakens.

   Model

   What has to hold

   Bonded value remains large relative to pooled assets under the paper's security argument.

   Falsifier

   What would retire it

   What is bonded value relative to pooled value today, not in the paper's illustration?

4. 04 Churn keeps the set fresh

   Observation

   What the study says

   Membership rotates. A static multisig of founders is not the design. Whether the rotation is real is an operational fact.

   Model

   What has to hold

   Outbound transactions can actually be built. A chain that changes address rules or fees can stall withdrawals.

   Falsifier

   What would retire it

   Which failures were implementation bugs rather than failures of the invariant?

5. 05 Observation of other chains is a consensus job

   Observation

   What the study says

   Nodes must agree that a bitcoin transaction happened before they credit a pool. A failure of observation is a failure of the swap, even if the pool math is right.

   Model

   What has to hold

   A threshold of nodes is honest and online for both observation and signing.

   Falsifier

   What would retire it

   How many confirmations does each chain require before credit?

03 Sequence

One action, as an operating tape

1. 01A user sends native asset A to a vault address the network controls.
2. 02Nodes observe the inbound transaction on A's chain and agree it is final enough.
3. 03The protocol credits the swap and computes the output of asset B from the pool invariant, minus the fee.
4. 04A vault on B's chain sends the outbound transaction. Nodes sign it under the threshold scheme.
5. 05If an outbound fails or a vault is mishandled, the paper's slashing rules take the cost from bonds.

04 Load-bearing

The argument, and where a pitch drops it

1. The invariant is not the risk

   The cut

   Constant product will do what it always does. The new risk is a vault key. Threshold signatures, rotation, and an economic bond are the actual design. A review that spends its time on the AMM curve has reviewed the easy half.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   A threshold signer set can still collude. The paper prices that risk with bonds. It does not define it away.

2. Security scales with the bond, not with the brand

   The cut

   The paper's honesty condition is roughly that stealing the pooled assets should be worth less than the bond that would be lost, given the chance of being caught. When total value locked races ahead of bonded value, that sentence stops being true. It has to be re-measured. It cannot be inherited from the white paper's examples.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   Later parameters, vault schemes and incident history are not the white paper, and this page does not narrate them as if they were.

3. Cross-chain finality is heterogeneous

   The cut

   Bitcoin's idea of final and a fast chain's idea of final are different ages. The protocol must pick a confirmation depth per chain. Pick too small, and a reorg double-spends the pool. Pick too large, and the swap is no longer what users call instant.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   A later client, parameter or reward formula is a different object from this paragraph.

05 Register

What has to be true

• Model · Not re-measured

  Bonded value remains large relative to pooled assets under the paper's security argument.

• Stake and threshold · Not re-measured

  A threshold of nodes is honest and online for both observation and signing.

• Model · Not re-measured

  Each external chain's confirmation rule is conservative enough for that chain's reorg behaviour.

• Model · Not re-measured

  Outbound transactions can actually be built. A chain that changes address rules or fees can stall withdrawals.

06 Divergence

What happened after the paper

THORChain launched and suffered exploits around router and vault logic that were about implementation and operational security, not about the constant-product formula. Those losses are part of how the design should be taught: the bond did not make buggy signing code harmless. The paper's model remains the right checklist, and it is not a claim that the checklist was always met.

A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.

07 Pre-mortem

What to check before you use the idea

1. Kill test 1What is bonded value relative to pooled value today, not in the paper's illustration?
2. Kill test 2How many confirmations does each chain require before credit?
3. Kill test 3How is the vault key threshold set, and how often do members rotate?
4. Kill test 4Which failures were implementation bugs rather than failures of the invariant?
5. 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.

08 Anatomy

The paper, in the order a builder needs

09 Lexicon

Terms, opened into the record

Bond

Collateral posted by a node, intended to be slashable if the node participates in mishandling funds.

Vault

An address on an external chain controlled by a threshold of nodes, holding pooled assets.

Observation

The network's agreement that an inbound transaction on another chain is final enough to credit.

Continuous liquidity pool

The on-network curve that prices the swap once custody and observation have done their jobs.

10 Repository

Every linked record on this page

Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.

11 Related

The next papers, as theses

• Cosmos · 2016

  Cosmos: A Network of Distributed Ledgers

  The Cosmos paper: independent zones running a BFT consensus, connected by a hub, speaking a packet protocol that later became IBC. Unlike Polkadot's shared-security vision, zones here are sovereign. They choose their own validator sets.

• Uniswap · 2020

  Uniswap v2 Core

  The 2020 core paper for Uniswap v2: a constant-product automated market maker, with arbitrary ERC-20 pairs, price accumulators, and a flash-swap callback. It is the clearest short specification of the pool that much of later DeFi either forked or assumed.

• Bancor · 2017

  Bancor Protocol: Continuous Liquidity and Asynchronous Price Discovery for Tokens through their Smart Contracts

  The 2017 Bancor paper on smart tokens that hold reserves of other tokens and quote a continuous price from a reserve ratio. It is an early automated-liquidity design, distinct from Uniswap's later constant-product pools.