Trust model
What is verified, what is declared.
A passport is only useful if you know exactly what you are trusting. This page lists every field, how it is checked, and the one fill model every paper record uses.
Scope
Field by field
So you know exactly what you are trusting, every passport marks each field one way or the other. The full threat model is in the docs.
| Field | Status | How |
|---|---|---|
| Decision existed no later than its seal, unchanged since | verified | hash in a Merkle root; root and block time on chain |
| Decision sealed before its outcome | verified | block time of the seal vs the sealed exit; passport shows "sealed after outcome: N" |
| Completeness: no deleted or inserted decisions | verified | position numbers with no gaps, batch windows that never overlap and only move forward, every batch fetched |
| Prices and fills | declared model checkable (agents, dry-run) | Agents service: taken by Quantt from chain state at T+5 s; reserves and block are in the leaf, re-readable from an archive node once its batches go on chain. Our two bots (live record since 25 Sep): priced by the engine's v3 drift model (declared, see fills) |
| Computed results (P&L, max drawdown, win rate, lower bound) | verified | recomputed from the sealed decisions by the verifier; each passport carries a metricsHash ready for publishSnapshot (not yet published on chain) |
| Agent type, model and version, prompt hash, description | declared | signed by the owner at registration; fixed by hash, not checked by the chain |
| Owner identity beyond the wallet | declared | "L0 · wallet signed" is the only level today; levels 1–3 (socials, domain, organisation) designed |
| The agent recorded every decision it made | not proven | an agent can decide and not send; short and sparse records are flagged |
| A paper fill was achievable in a real block | not proven | block competition is not modelled; live mode with receipts is the guarantee |
Fills
One fill model for everyone
A paper result is only comparable if nobody gets a kinder model. Quantt prices every fill itself from chain state, with costs measured on Robinhood Chain: own price impact, venue fees, token taxes and gas. Our own bots' record started under the earlier v3 model and keeps it, labelled on every page.
The full fill model
- Price
- Chain state at T+5 s (v4 model, agents connected via the intake): the same standard delay for everyone, no percentage "drift" assumption. Our two bots (live record since 25 Sep), v3 model: chain price at the signal + 5% entry drift + 0.0004 ETH gas per round trip. Both stated on every passport.
- Own impact
- Constant-product math against real reserves for Uniswap v2 pools; for v3/v4 pools the active range is treated as constant product (an approximation inside one tick range, used by our bots' engine); launchpad curve formula for bonding-curve tokens, effective curve depth 1.81 ETH (10th percentile over 1,988 signals, chosen to overstate impact).
- Venue fees
- 1% per leg. Full launchpad round trip (fee + impact) measured at 4.7%; the engine charges that for our bots. The agent intake charges 1% per leg; its bonding-curve source is a stub today (established-crypto pools are the tested path). Pool fee per pool for migrated tokens.
- Gas
- 0.0000104 ETH per round trip, measured: median of 250 buys and 250 sells, cross-checked against sender balance changes on 12 transactions (0.0% difference). The earlier 0.0004 ETH assumption was 40× too high; every backtest was recomputed. Our two bots still charge 0.0004 ETH in their committed decisions (conservative): on a 0.01 ETH trade that is 4 percentage points, so at the measured gas their mean multiples would be about 0.039 higher.
- Token taxes
- Per-token buy and sell transfer taxes applied when the token has them.
- Stops
- A stop or trailing exit fills below its trigger, not at it.
- Valuation
- Open positions marked at what a full-size sell would return, not at the mid price.
- Executability
- Each round trip is checked; skipped signals are logged with their reason and counted in the passport as "skipped". Our own selection was replayed with eth_call at the block after the signal, not with heuristics.
- Size caps
- Fresh tokens (<30 days): ≤0.1% of supply and ≤2% of curve or pool ETH. Established crypto: ≤1% of pool liquidity. Tokenized stocks: ≤1% of daily volume, later. Oversized decisions are partially filled up to the cap and flagged "size capped". The declared maximum share of starting capital is shown next to the actual largest position on every passport, so any overshoot is visible.
Block competition is not modelled. The fill assumes the agent is the first taker after T+5 s; other takers in the same block, MEV and failed transactions are not simulated. Reserves at block N are the state after block N. Paper is not money: real fills can be worse. A live mode that reconciles every paper decision with a real receipt is designed, not built.