Evidence packet
Wallet history, funding path, stake accumulation and recovery, trade execution, market data, and a source-dated treasury snapshot. For a launch-covenant record, the packet is the disclosed terms at issuance.
Color-team library · six specialist teams
One proposal.Every angle.
One shared evidence layer, six bounded lines of inquiry. Each team returns its own finding so certainty in one lane cannot hide uncertainty in another.
6bounded reviews
1evidence layer
0composite scores
Pink Team · evidence qualificationcontract v1.1.0
Qualify the evidence.
Before a proposal gets a vector classification, the Pink Team records what is present, what is missing, and how current it is. Gaps remain visible instead of being converted into reassuring results.
Coverage state
Availability, confidence, source freshness, field-level forensic coverage, and an explicit withheld classification when evidence is incomplete.
Qualified record
Complete forensic evidence can move to vector matching. Partial and unavailable packets keep their uncertainty attached for every downstream team.
Wallet historyFunding pathStake accumulationStake recoveryTrade evidence
Red Team · attack testingcontract v1.0.0
Try to break it.
The Red Team runs versioned economic attack playbooks against qualified evidence. Every result belongs to one mechanism: indicators are never added across vectors into a composite score, and no match is not a claim of safety. Documented vectors join the library before their detectors ship — each one names the evidence its detector still needs, and none of them ever produces a classification.
Qualified packet
A Pink-qualified evidence packet: wallet history, funding path, accumulation, stake recovery, and execution series for the proposal under review.
Vector finding
A count of matched indicators and a classification scoped to one monitored vector, or an explicit withheld state when the packet is incomplete.
Scoped result
The finding travels with its vector id, version, and scope note; the White Team checks the claim boundary before anything is published.
Attack-vector library · 6 dossiers
Choose a vector
Show one vector at a time. Monitored vectors have a shipped detector; documented vectors stay non-classifying until their detector ships.
Economic governance attack · v1.0.0 · Monitored — detector shipped
Recycled-stake treasury extraction
A proposer acquires the required stake, rapidly recovers and reuses it in the decision market, with wallet-funding and execution behavior providing supporting evidence.
This classification is scoped to one monitored attack vector, not a validated composite proposal-risk score or a complete claim of safety.
Monitored indicators
01 · Identity context
Fresh wallet with no prior history
02 · Funding context
Cross-chain / bridge funding
03 · Eligibility acquisition
Accumulation trimmed to exact proposal-stake threshold
04 · Capital reuse
Stake recovered and reused in the decision market
05 · Market execution
Clustered fixed-size cadence trades
Published cases
Published case · 5 August 2026
Umbra
Evidence the detector consumes
01 · Required evidence
Wallet history: first activity and prior onchain record
02 · Required evidence
Funding path: venues and source chains for each leg
03 · Required evidence
Stake accumulation and trim relative to the required threshold
04 · Required evidence
Stake recovery latency and decision-market reuse
05 · Required evidence
Trade execution series, or a published cadence summary
Decision-market manipulation · v1.0.0 · Monitored — detector shipped
Late-window TWAP outcome steering
A trader waits out most of the TWAP window, then pushes a marginal print across its threshold in the closing stretch — when the required move is fully known and defenders have the least accrual time left to trade the price back. Late trades carry the least time-weight, so the target is a market already near its threshold, not the TWAP itself. Late activity also has benign forms — organic close-out and activist pressure — so a detector must separate steering from ordinary end-of-window trading.
This classification is scoped to one monitored attack vector, not a validated composite proposal-risk score or a complete claim of safety.
Monitored indicators
01 · Timing
Aligned volume concentrated in the closing hours of the TWAP window
02 · Fragility
Printed outcome crosses the threshold on one marginal trade
03 · Liquidity
Price move outsized against posted depth near the threshold
04 · Reversal
Price snaps back once TWAP weight stops accruing
05 · Threshold pressure
Intra-window spike alone would clear the configured threshold
Evidence the detector consumes
01 · Required evidence
Indexed per-trade history with in-window timestamps
02 · Required evidence
TWAP window boundaries and per-trade accrued weight
03 · Required evidence
Depth series around the configured threshold
04 · Required evidence
Post-finalization price series for snap-back checks
Decision-market manipulation · v1.0.0 · Monitored — detector shipped
Wash-volume alignment inflation
Automated near-neutral flow inflates a market's apparent volume and economic alignment, dressing thin conviction up as broad support while contributing no real position either way. The same fingerprint matches benign arbitrage flow, which published analysis strips as routine; a detector must separate deliberate wash from ordinary arb before it can say anything.
This classification is scoped to one monitored attack vector, not a validated composite proposal-risk score or a complete claim of safety.
Monitored indicators
01 · Execution symmetry
Paired pass-market and fail-market executions from one wallet
02 · Cadence
Fixed-size trade clusters at machine cadence
03 · Exposure
Near-neutral ending exposure despite high turnover
04 · Frequency
Per-wallet trade frequency in the arbitrage band
05 · Alignment distortion
Net volume tilt moves materially once the flow is stripped
Evidence the detector consumes
01 · Required evidence
Wallet-attributed trade history across both conditional markets
02 · Required evidence
Ending pass/fail exposure per wallet
03 · Required evidence
Per-wallet trade frequency over the market's lifetime
04 · Required evidence
Volume tilt recomputed with the suspect flow removed
Economic governance attack · v1.0.0 · Monitored — detector shipped
Coordinated multi-wallet stake assembly
An operator splits stake acquisition or market activity across coordinated wallets so no single address crosses the eligibility thresholds the protocol enforces or the attribution thresholds a reviewer watches. Coordination alone is not an attack — multi-wallet holders and coordinated defenders share parts of this shape — so the mechanism is the threshold evasion, not the wallet count.
This classification is scoped to one monitored attack vector, not a validated composite proposal-risk score or a complete claim of safety.
Monitored indicators
01 · Funding context
Participating wallets funded from one upstream source
02 · Identity context
Wallets first active inside a tight shared window
03 · Eligibility acquisition
Combined position crosses a stake threshold no single wallet crosses
04 · Market execution
Matching trade-size and cadence fingerprint across wallets
05 · Exit behavior
Coordinated exit across the wallet set after resolution
Evidence the detector consumes
01 · Required evidence
Cross-wallet funding graph for the proposal window
02 · Required evidence
First-activity timestamps for each participating wallet
03 · Required evidence
Per-wallet positions measured against the stake requirement
04 · Required evidence
Per-wallet execution series for fingerprint comparison
Decision-market manipulation · v1.0.0 · Documented — detector pending
Terminal-window TWAP capture
A governance rule resolves on a TWAP measured over only a short terminal slice of a much longer decision period, on pools that need only clear a published minimum-liquidity floor. The entire resolving window is the closing stretch: the capital needed to own the print is calculable in advance from the floor and the window length, and defenders have no earlier accrual to lean on. Distinct from late-window outcome steering, which targets the tail of a full-length TWAP window — here the rule itself confines every unit of resolving weight to the terminal window. Genuine late information arrival produces the same late repricing, so a detector must separate engineered capture from honest end-of-period discovery.
This vector is documented, not monitored: its detector has not shipped, so it never produces a classification. The definition records the mechanism and the evidence a detector would need first.
Defined indicators
01 · Window structure
All resolving TWAP weight accrues in a terminal window that is a small fraction of the decision period
02 · Liquidity
Full-range depth sits at or barely above the published liquidity floor
03 · Timing
Markets stay quiet until the resolving window opens, then absorb concentrated aligned flow
04 · Fragility
Pass/fail ordering flips inside the resolving window after holding steady before it
05 · Reversal
Prices revert once the terminal window closes and weight stops accruing
Evidence a detector needs first
01 · Required evidence
The ratified rule: resolving-window length, liquidity floor, and pass condition as published
02 · Required evidence
Pool depth series across the decision period, with full-range liquidity measured against the floor
03 · Required evidence
Per-trade history with timestamps covering pre-window and in-window activity
04 · Required evidence
Post-resolution price series for reversion checks
Methodology sources
Governance-signal manipulation · v1.0.0 · Documented — detector pending
Advisory-signal inflation
Where a decision market is advisory — its price signal informs a vote or a bound delegate but executes nothing — moving the signal is cheap: no treasury settlement forces the manipulator to hold losing risk, and thin honest flow is the norm. An inflated print then travels as social proof through forums, delegates, and dashboards that cite the market as an endorsement. Honest participants also trade advisory markets at low volume, so a detector must separate manufactured endorsement from a thin but genuine signal.
This vector is documented, not monitored: its detector has not shipped, so it never produces a classification. The definition records the mechanism and the evidence a detector would need first.
Defined indicators
01 · Exposure
Directional prints arrive without exposure held through the signal read
02 · Capital sizing
Signal-moving flow is trivial against the decision's stated stakes
03 · Timing
Aligned flow concentrates just before the signal is read or a bound delegate executes
04 · Cross-check
Market signal diverges from the venue's own vote and forum alignment
05 · Reversal
Positions unwind once the advisory signal has been consumed
Evidence a detector needs first
01 · Required evidence
The advisory rule as published: what reads the signal, when, and at what threshold
02 · Required evidence
Wallet-attributed trade history across both conditional markets
03 · Required evidence
Timestamps of signal reads or bound-delegate executions against the flow series
04 · Required evidence
Position series after the signal is consumed, for unwind checks
Methodology sources
Saved data structure
Machine-readable library
The versioned vector definitions and team contracts ship as JSON — status, indicators, evidence requirements, methodology sources, case provenance, and boundaries.
Blue Team · market watchcontract v1.2.0
Watch the market.
The Blue Team reads confirmed proposal state, pass-market and fail-market TWAPs, and the DAO’s configured threshold. Its market finding stays separate from the Red Team’s forensic result.
Confirmed accounts
Futarchy proposal and DAO accounts provide current state, proposal class, the configured threshold, and pass/fail TWAP accumulators.
Threshold read
The pass-market TWAP must strictly beat the configured threshold over the fail-market TWAP. A late-window pressure watch describes the retained observation series — margin against threshold, contested crossings, and closing-stretch moves. A flip-cost scenario states the floor on moving a conditional print at disclosed depth. Live math remains provisional until finalization.
Defense watch
Market state travels beside forensic context without standing in for missing wallet history, volume, or execution evidence.
Live surface
Open live markets Confirmed Futarchy activity
Inspect pending markets, funded drafts, proposal-specific thresholds, and current pass/fail TWAPs.
InstrumentFlip-cost scenario v1.0.0
Lower bound
What moving the print costs
The floor on pushing one conditional pool's print past its threshold at disclosed depth, published with its assumptions attached — a floor rather than a cost, and never a safety rating.
Yellow Team · playbook buildingcontract v1.1.0
Codify the research.
The Yellow Team turns published investigations into reusable definitions. The mechanism gets a stable name, version, scope note, indicators, and case provenance; the incident never becomes the detector.
Published intelligence
Cited proposal records, market math, wallet forensics, and explicit observations from the cited source research.
Runnable definition
A versioned mechanism with ordered indicators and a scope boundary that can be assessed independently, and covenant checks versioned against published launch terms.
Standing check
The Red Team receives a reusable playbook; published cases remain provenance beneath it rather than hard-coded classifications.
Attack playbooks4 monitored playbooks · 2 documented
Economic governance attack
Recycled-stake treasury extraction
v1.0.0 · monitored · 5 indicators · 1 published case
Decision-market manipulation
Late-window TWAP outcome steering
v1.0.0 · monitored · 5 indicators · 0 published cases
Decision-market manipulation
Wash-volume alignment inflation
v1.0.0 · monitored · 5 indicators · 0 published cases
Economic governance attack
Coordinated multi-wallet stake assembly
v1.0.0 · monitored · 5 indicators · 0 published cases
Decision-market manipulation
Terminal-window TWAP capture
v1.0.0 · documented · 5 indicators · detector pending
Governance-signal manipulation
Advisory-signal inflation
v1.0.0 · documented · 5 indicators · detector pending
Covenant checks6 versioned against published STAMP terms
Covenant check
Use of proceeds restricted
v1.0.0 · Funds can only be used for product development and operating expenses.
Covenant check
Investor reserve capped and non-dilutable
v1.0.0 · Investor reserve at most 20% of total project tokens and not dilutable post-agreement.
Covenant check
Team allocation in band with milestone vesting
v1.0.0 · Team allocation between 10% and 40% of total supply on milestone-based vesting.
Covenant check
Linear unlock schedule
v1.0.0 · Tokens enter a 24-month linear unlock once the Delivery Notice is received.
Covenant check
Cayman SPC/SP entity created
v1.0.0 · Founders create a Cayman SPC/SP entity through the venue interface.
Covenant check
Third-party review commissioned
v1.0.0 · A third-party review of the covenant or programs exists. STAMP itself requires none, so absence is the venue default, not a violation.
Purple Team · learning loopcontract v1.0.0
Close the loop.
The Purple Team links what the Red Team learned in published cases with what the Blue Team should watch next. It carries the check forward, not the old case’s conclusion.
Closed cases
Published incidents with their evidence, market outcome, and vector result preserved together as cited replays.
Standing checks
Reusable, versioned checks extracted from incidents and returned to the active watch for future proposals.
Refreshed watch
The Blue Team and Red Team receive the updated check; the old case keeps its citation and stays a replay.
- 01
Preserve the incident
Keep the proposal, source, evidence, market outcome, and vector result together as a cited replay.
- 02
Extract the mechanism
Separate reusable indicators from project names and one-off narrative details.
- 03
Return it to watch
Give future proposal reviews the versioned check while requiring their own evidence and market state.
Operational memory
Browse proposal cases Published proposal cases
Review the source-linked cases that produced reusable checks.
White Team · claim controlcontract v1.1.0
Keep claims honest.
The White Team checks the boundary around every published conclusion: what was measured, which vector it belongs to, whether evidence was complete, and what the result cannot establish.
Draft findings
Every team’s finding with its evidence state, vector scope, and data vintage attached.
Publishable claims
Claims trimmed to what the evidence establishes, with withheld states left explicit rather than rounded to safe.
Published record
Only scoped, cited claims reach the page; anything broader goes back to the team that made it.
HIGH-RISKELEVATEDWATCHNO-MATCH
Count-based matches for one complete, named attack vector. They are not a composite proposal-risk score.
UNSCOREDUNKNOWNSTALEUNDER_REVIEW
Evidence or review state prevents a vector conclusion. Uncertainty remains explicit.
presentabsentunknown
Tri-state, fail-closed review of a launch covenant's disclosed terms. Unknown never rounds to present, and a covenant review is not a proposal classification.