No key. No delete. No hindsight.
A call is encrypted in your browser to the drand round at the market’s close (tlock, quicknet). The commitment, sha256 of the ciphertext, goes on Solana in a memo you sign. The slot is the timestamp. When the round lands, the opener decrypts every registered ciphertext with the public beacon, checks it against the rules, and publishes it, hit or miss. The grader scores it from the outcome source and publishes its inputs so anyone can replay the grade.
The score
Brier score BS = (p − outcome)². Skill against a coin flip: s = 1 − BS / 0.25, so +1 is perfect and −3 is a 100% call that missed. A caller’s board score is the lower bound of their mean skill, LB = mean − 1.645 · sd / √n, ranked from 10 graded calls over at least 3 Opens; ties go to the larger n.
Worked examples
1. A seals "SOL ≥ $200 at Fri 20:00 UTC" at 70% on Wednesday; SOL closes above. BS 0.09 skill +0.64 2. B seals the same market at 95%; SOL closes below. BS 0.9025 skill −2.61 (overconfidence costs) 3. A seal inside the last 24 hours before close is invalid. So is a ciphertext whose hash differs from its memo, or a payload wallet that isn't the signer. 4. C has 3 perfect calls. D has 40 calls averaging +0.30 with sd 0.5: D's LB ≈ +0.17 and ranks. C isn't ranked yet (n < 10). 5. An epoch earns 8 SOL: 4.8 SOL to the top 10 pro rata by positive LB, 3.2 SOL buys back and burns $CALLS. A retry pays nothing twice.
The attacks, answered
- Sealing after the fact
- The seal's timestamp is its slot time on Solana, not anything we or you write. A seal must land at least 24 hours before the market resolves, so a call is a day-ahead forecast and no level is already decided when sealing closes; later seals open as invalid and are never graded. Registering the ciphertext late doesn't help either: the server refuses registrations after the same deadline.
- Reading a call early
- The payload is encrypted to a future drand round. Decryption needs that round's BLS signature, which the drand network produces only when the round arrives. There is no key to leak: we never have one.
- Forging a commitment or wallet
- The memo commits to sha256(ciphertext) and is signed by the wallet. At The Open the opener recomputes the hash, checks the wallet inside the payload against the memo's signer, and the ciphertext's round against the market's. Any mismatch is invalid.
- Selective reveal
- Every registered ciphertext for a round opens when the round lands: there is no step where a caller chooses. The memo can't be registered after the deadline, so a caller can't hold two opposite seals and register the winner later.
- Sybil spraying
- Each wallet is ranked on its own: the lower bound needs 10 graded calls over at least 3 Opens, sealed a day ahead, so a perfect run has to survive three genuine forecasts (one miss at 99% scores −2.92). Once $CALLS is live every seal burns 10,000 and needs 100,000 held, so fishing for one lucky wallet across many is paid for in burns.
- Manipulating a trench outcome
- A migration market resolves from the chain itself: the successful pump.fun migrate instruction for that curve, which can land only once, found by paging the curve's own history; a transaction that merely lists the curve can't impersonate it. Pushing a coin over the curve to win is possible, but it costs real SOL on the curve for a share of a prize split ten ways by lower bound, and the market is picked by the generator from the uncertain band, not by the caller.
- Double-paying an epoch
- Every money step writes its intent and signature to a ledger before and after sending; a retry reads the ledger and re-checks signatures on chain before doing anything. The treasury's guard refuses any instruction outside its four allowed shapes.
- Public totals above real sends
- Paid and burned totals are incremented only from confirmed signatures recorded in the ledger. Dry runs log and never count.
- drand or exchange outages
- If no relay serves the beacon, the opener waits and retries: calls stay sealed, never graded unverified. If the exchange has no candle yet, the market waits. Coinbase's historical candles stay available, so a late grade matches a replay years later.
Markets
Only markets that resolve automatically and unambiguously exist, generated from templates: SOL, BTC and ETH above a round level at The Open (the open of the 1-minute Coinbase candle at that minute; Pyth when a key is configured), and named pump.fun coins migrating by The Open (the pool creation on chain). Nobody writes free-text markets.