On-chain voting on Bitcoin Cash — primitives, the bicameral-sortition design, historical lineage, comparison with existing models, capture-cost analysis, and the operational bootstrap.
This is a public reference summarising the voting-systems design framework developed for the Deviant platform on Bitcoin Cash. The full technical materials live in the Deviant wiki (voting-systems.md for the design, voting-systems-bootstrap-playbook.md for the operational guide, ADR-0040 for the formal decision record). This document is the accessible summary for analysts evaluating the design.
The framework answers a specific question: how do you do on-chain voting where the system is rooted in something money cannot directly buy? The naive answer (token-weighted DAO) collapses to plutocracy. The framework's answer is a recombination of three well-tested democratic primitives — sortition, bicameralism, and bidirectional accountability — encoded as on-chain machinery on BCH.
The Deviant corpus opens with the following diagnosis:
When the institutional, technical, economic, and rhetorical forces all point in the same direction, the outcome they point toward becomes the default trajectory. Deviation from the trajectory requires active resistance. In a captured information environment with limited resistance capacity, the default trajectory is what occurs.
The voting-system design summarised here is the project's constructive answer to that diagnosis. Capture happens by inertia — institutions, markets, media, and dominant narratives align in one direction, and the absence of a coordinated counter-pressure makes that direction the default outcome. This isn't malice; it is the geometry of unopposed force. To get a different outcome, you need a system that produces active resistance as its default behaviour, not as exceptional heroism by individual actors who pay personal cost to deviate.
The bicameral-sortition design is that system. It defines what "active citizenship with skin in the game" operationally looks like, layer by layer:
| Opening's diagnosis | Voting system's answer |
|---|---|
| "Institutional forces all point in the same direction" | Bicameral sortition — admission requires consent from two independently sortitioned chambers; no single institution can align all of them |
| "Technical forces all point in the same direction" | All three integrity layers (qualification, counting, presentation) are removed from any trusted intermediary; the chain is the counter and the presenter, and the citizenry is the qualifier |
| "Economic forces all point in the same direction" | Removal-bond + per-vote-fee economics — capture cost scales with network size; cheap inertial capture becomes structurally impossible |
| "Rhetorical forces all point in the same direction" | Wallet trust-label discipline — the wallet surfaces the trust model, never asserts a framed result; rhetorical capture of the presentation layer is structurally blocked |
| "Captured information environment with limited resistance capacity" | Active citizens with skin in the game — admission is one-time costly, voting is paid-regardless-of-direction, constitutional removal pays for capture attempts |
| "Default trajectory is what occurs" | Default trajectory is what the active citizen body decides — deviation from any captured outcome is structurally cheaper than riding the default, because the protocol pays voters for participating and burns wealth that tries to override them |
The bicameral-sortition design is exactly the missing "resistance capacity" the opening names. Without an active citizen body that can decide differently from whichever default the institutional / technical / economic / rhetorical forces are pointing toward, the default trajectory wins by inertia. With it — with a body whose membership is sybil-resistant without KYC (§2.5), whose votes are sortitioned and secret, whose costs to attack scale with network size, and whose trust model is honestly labelled rather than rhetorically framed — deviation becomes structurally feasible rather than dependent on individual heroism.
Other projects can build voting systems. This one is the active-resistance mechanism for the captured-trajectory diagnosis that opens the Deviant corpus. The mechanism stack is the project's answer to its own founding problem — a society of active citizens with skin in the game, organised so that deviation from the captured default is the default behaviour of the protocol itself.
Before choosing a mechanism, decide which question the vote is asking. Different questions have different morally-correct answers — and the wrong tool for the question produces unfairness even with perfect execution.
| Vote kind | Goal | Right tool |
|---|---|---|
| Stake-weighted (DAO treasuries, shareholder votes) | More skin-in-the-game ⇒ more weight | StakeVoteTote (pool-comparison settlement) |
| Closed-membership (board, committee, fixed roster) | One member, one vote — set known at genesis | PollCovenant (per-voter MTA-class issuance) |
| Rolling membership (DAO with onboarding) | One member, one vote — set grows over time | PollCovenant (MCA-class issuance) |
| Open one-person-one-vote (universal suffrage) | Universal, unique humans | PollCovenant + identity-attestation oracle (proof-of-personhood) |
The trap to avoid: picking stake-weighted for a question that is morally one-person-one-vote. The wallet must label which model is in front of the voter so this choice is conscious and visible.
Voting systems are easier to reason about — and easier to compare across history — when split into three independent attack surfaces. Each layer can be strong or broken regardless of the others. Most historical voting failures are one-layer breaks; a complete system is only as strong as its weakest layer.
| Layer | Question | Failure mode if controlled by a trusted intermediary |
|---|---|---|
| 1. Qualification | Who is allowed to vote? | A captured registrar admits illegitimate voters, allows double-voting, lets sybils participate, or excludes eligible voters |
| 2. Counting | Who counts the votes? | A captured counter miscounts — by error, by fraud, by selective inclusion / exclusion, by stopping the count early, by recounting until a target result emerges |
| 3. Presentation | Who displays the results? | A captured presenter misreports — calls the election early, announces false totals, refuses detailed disclosure, presents data selectively |
The layers nest. Layer 3 can only honestly present what Layer 2 correctly counted; Layer 2 can only correctly count what Layer 1 legitimately qualified. A break at any layer poisons the layers above. A voting system is integral only when all three are removed from any trusted intermediary — not just one.
| Layer | What removes the trusted intermediary | Mechanisms in this design |
|---|---|---|
| 1. Qualification | Bicameral sortition replaces "the registrar" with a distributed, randomly-sampled process anchored in social attestation (pre-gate), sortitioned voting twice (Citizens + Delegated), and Elder consent for constitutional cases. No single party controls admission | The entire §3 framework above — three-stage gating, ranks, Elder + founder tier, removal-bond + per-vote-fee economic friction |
| 2. Counting | The covenant is the counter. CashScript bytecode verified by every full node enforces that each admitted ballot increments the tally exactly once, no out-of-set ballots are counted, no in-set ballots are dropped, the close condition is reached deterministically. No human or institution participates | TallyState, CommitRevealVote, ApplicationCovenant, the co-spend-as-oracle pattern for downstream markets reading the result trustlessly |
| 3. Presentation | The chain state is the presentation surface. Anyone with a node retrieves the same bytes from the same canonical UTXO. Wallets verify the chain state and label the trust model (sybil basis, threshold, phase) — they never authorise a result. No spokesperson, no media call, no aggregator framing | Verifier-not-authority wallet discipline; raw covenant state queryable from any node forever; public registry indexable by any party; sybil-basis labelling applied at display time |
On a public blockchain, Layers 2 and 3 are trustless by construction:
Layer 1 is the hard layer — and it is hard sociotechnically, not technically:
What this frame pins down:
Each addresses a different concern; they compose. All three are chipnet-validated.
PollCovenant — per-voter allowlisted tokenEach voter holds a covenant UTXO bound to their public key hash; voting consumes the UTXO and routes its full value into one of two ballot-box addresses; double-vote is structurally impossible (UTXO consumed on cast). Sybil resistance lives in the issuer's allowlist — the issuer chooses which public keys receive voter tokens.
TallyState — trustless on-chain tallyA stateful covenant holding {phase, outcome, countA, countB} in its NFT commitment. vote() increments the chosen counter; close() permissionlessly fixes the outcome from the counters (bigger pool wins); a readOnly() path lets external covenants co-spend the closed tally to read its outcome without modifying it. No named oracle.
StakeVoteTote — stake-weighted vote via pool comparisonVariant of a pari-mutuel tote where settle() reads the two side totals and picks the bigger pool as winner. Winners split the whole pool pro-rata; losing-side stakes flow to winners. Plutocratic by design — appropriate for stakeholder votes where capital-at-stake should determine outcomes.
The qualification filter requires no KYC at any layer. The chain only ever sees pubkey hashes — never names, government IDs, addresses, biometrics, or any other real-world identity attribute. Sybil resistance comes from distributed social attestation, not from centralised identity verification.
| KYC (what this design REJECTS) | Social proof (what this design USES) | |
|---|---|---|
| What's revealed | Real name, government ID, address, sometimes biometrics | A pubkey hash. Nothing else. |
| Who verifies | A central authority (state, exchange, KYC vendor) | The existing citizen body itself |
| Sybil resistance via | "We checked your ID" | "15 existing Citizens with voting rights signed a statement saying you are a real human they know" |
| Attack-surface shape | Direct, immediate. Bribing the issuer once produces a fully-verified identity. Effect is multiplicative: repeat the bribe → unlimited verified identities | Structurally diminishing. Bribing 15 Citizens does NOT produce admission — it only passes one of THREE gates. The other two (15-of-29 sortitioned Citizens + 15-of-29 sortitioned Delegated) draw randomly from the pool AFTER the bribe; the attacker's bribed endorsers cannot help in either. The bribe's effect vanishes through each subsequent layer. |
| Privacy cost | Identity stored in some database, subject to leaks, subpoenas, deanonymisation | Pseudonymous forever. The address is the identity. |
An earlier version of this subsection (and the corresponding wiki/voting-systems.md section) presented a "~870 bribes per identity" figure with a "three orders of magnitude vs KYC" claim. Both were wrong. The error: conflating one-time pool-corruption capability investment with per-identity stochastic burn, and treating ~52 % of the pool as reliable capture when the hypergeometric distribution actually gives only ~50 % per-attempt success at that bribed fraction. The corrected analysis below uses the Vector A / Vector B framing from the athenae_protocol_technical_spec_v0_1.md §9 — costs combine multiplicatively across independent attack surfaces, not linearly per identity.
A KYC bribe yields one verified identity per bribe — linear cost, deterministic effect. A social-proof bribe must defeat three independent layers, and the shape of cost differs between them.
KYC bribery — linear and deterministic. Cost c · n for n forged identities; effect probability per bribe = 1.0. Detectability: low (the issuer doesn't publish a "I attested these identities" bundle).
Social-proof bribery — two cost categories that compose differently:
| Cost category | Shape | When paid |
|---|---|---|
| One-time capture-capability investment | Bribe ~60 % of each sortitioned pool (Citizens for Stage 1, Delegated for Stage 2). Paid once for the capability, not per identity. | At infiltration setup |
| Per-identity pre-gate cost | 15 endorsement bribes. Amortises across identities only if uniqueness defenses are absent; with rate-limit + adaptive uniqueness active, marginal cost scales back with N. | Per identity |
| Per-identity stochastic burn | Escrow burn × (1 / P_success_per_attempt). At 60 % pool corruption, hypergeometric P(≥15 of 29 bribed) ≈ 85 % per stage, ≈ 72 % combined — so ~1.4 expected attempts per successful admission. | Per identity attempt |
Why the sortitioned stages don't have a "stable bloc" attack. Sortition specifically destroys the attack model where a small bribed group reliably votes the attacker's way. An attacker cannot bribe a specific 15 Citizens and have them be the ones sortitioned — the chain draws randomly from M. So the attacker must either bribe a large fraction of the entire pool and accept probabilistic per-attempt capture, or accept that bribing a fixed small group is essentially useless. There is no middle path.
Vector A — concrete cost at mature scale (from the Athenae spec):
The earlier "three orders of magnitude per identity" framing was wrong. The honest version is: a 10–100× cost ratio combined with a 100–1000× time horizon, where the product is large but the cost and time have different shapes. The asymmetry comes from multiplicative composition of independent attack surfaces — capital AND social-network penetration AND time AND no-detection-by-Elders must all succeed simultaneously — not from linear per-identity bribery.
EndorsementCovenantCorrection (2026-06-03): an earlier version of this section argued the pre-gate could be off-chain on cost / "sortition-does-the-real-work" grounds. That was wrong. Off-chain attestation introduces a trusted verifier (whoever counts the signatures and decides "yes, these are valid") — a single point of trust the design specifically exists to eliminate. The chain itself is the right enforcer, and the per-applicant EndorsementCovenant is the load-bearing primitive.
Design: per-applicant EndorsementCovenant UTXO with 8-byte commitment endorsementCount(8 bytes LE) and two functions:
endorse() — co-spent with the endorser's CitizenToken (input 1). The covenant verifies the endorser's rank is 0x01 / 0x02 / 0x03 / 0x04 (any voting-rights rank). The counter increments; cap at threshold. The endorser's CitizenToken.vote() runs at input 1 simultaneously, authorising the endorsement via the holder's signature.graduate() — anyone-callable when count >= threshold. Consumes the EndorsementCovenant UTXO; the downstream sortitioned voting chambers (Stages 1 + 2) become eligible.Why on-chain is strictly better than off-chain here:
applicantPkh).Cost is trivial. At BCH fee levels, 15 endorsement transactions cost sub-cent total. A mature network with 100 admissions per day burns ~1 500 endorsement transactions daily — under $0.15 per day of network-wide endorsement cost. The chain-bloat argument that motivates off-chain attestation elsewhere does not apply at this scale.
What the chain CAN enforce, the chain SHOULD enforce. Trust delegation to off-chain verifiers is acceptable only where the chain literally cannot verify the claim (e.g., personhood — no chain can prove a pubkey corresponds to a unique human). The pre-gate's claim — "15 endorsers, each holding a valid CitizenToken with voting rights" — is something the chain CAN verify, so it MUST verify it.
Chipnet-validated 2026-06-03: EndorsementCovenant.cash + driver chipnet-endorsement-test.mjs; 11/11 tests pass including over-endorse rejection (line 70) and premature-graduate rejection (line 91).
The flagship design for one-person-one-vote questions. A complete framework that aims at the constraint "voting weight tied to something money cannot directly buy" by routing legitimacy through social vetting + sortition + amortised one-time admission.
| Rank | Role |
|---|---|
| Citizen | Right to vote in any poll; vouch in the regular chamber of admissions |
| Delegated Member | Privileged attester; vouch in the random delegated chamber; higher reward share |
| Elder (Super-Delegated) | Rare, prestigious; required only for special escalations (final confirmation of high-stakes demotion; defence against complaint-spam attacks). Hard to earn, hard to lose. |
| Founder | Permanent (by deliberate choice — not auto-sunset). Bootstrap authority + reserve crisis-response role. Bounded by an eight-layer mitigation stack (see §6). |
Movement is bidirectional and symmetric: the same process that admits a Citizen can demote one; the same process that promotes a Delegated Member can demote one. Every privilege is contestable through the same machinery used to grant it.
Every admission and every demotion runs through three independent stages, in order:
Neither voting chamber is candidate-controlled. The candidate's friends only sign the pre-gate (auditable, accountable — if the admit later turns out fraudulent, the endorsers risk their own status). Both actual votes are sortitioned.
Random selection of jurors is the core anti-coordination mechanism. The covenant pins a future block height as entropy; the block hash deterministically selects the jurors. If a juror doesn't vote in time, they're replaced by the next sortition draw — no-show griefing cannot stall the process. The number of jurors drawn is whatever it takes to fill the 15 confirmation slots or hit the rejection ceiling.
To prevent endless retries, the random chambers operate under a 29-attempt cap: 15 yes admits, 15 nos disqualifies. This is a probabilistic majority filter:
| Cap setting | Real support needed | Filter strictness |
|---|---|---|
| 21 attempts, 15 yes | ~71% | Strict — high consensus required (used for Elder admissions and constitutional demotions) |
| 29 attempts, 15 yes | ~52% | Majority — honest plurality threshold (standard routine admissions) |
| 45 attempts, 15 yes | ~33% | Loose — would let minority candidates pass |
The choice of 29 is a constitutional decision encoding the community's philosophy of inclusion vs. exclusion — it is not a casual tunable.
The candidate pays a fee at application; each voucher who participates collects their share regardless of how they voted. This separates two normally-conflated incentives:
Pay-regardless defangs bribery by construction. The reward split is 40/60 favouring Delegated Members — creating an incentive ladder (Citizens earn voting fees; Delegated earn more; the community is motivated to climb).
The three structural choices each recover a well-documented democratic primitive.
| Era | Implementation |
|---|---|
| Athenian democracy (5th–4th c. BCE) | The kleroterion — a stone allotment machine that randomly drew ~600 magistrates/year and juries of 201–6,000 citizens. The Boule (Council of 500) was sortitioned from the ten tribes. |
| Italian republics | Florence's imborsazione + tratta; Venice's Doge selection used 11 alternating sortition/voting rounds (1268–1797). |
| Anglo-American common law | Random selection of jurors from voter rolls — the structural anti-corruption mechanism in trials. |
| Modern citizens' assemblies | Ireland (2016–18 abortion + marriage referenda), British Columbia (2004 electoral reform), Iceland (2010 constitutional council). |
Athens used sortition as the default for most public offices on the explicit reasoning: elections produce oligarchy; lots produce democracy.
| Roman Republic | Senate (appointed nobles, lifetime) + Centuriate/Tribal Assemblies (citizens, voting) + the tribune's intercessio veto. |
| Medieval England | Parliament split into House of Lords (1341) and House of Commons. |
| U.S. Constitution (1787) | Senate (per-state equality) + House (per-population). The Great Compromise built bicameralism explicitly to balance small-vs-large-state power. |
The constant insight: two chambers selected by different methods filter different concerns. Either chamber can veto; neither can act alone.
| Athenian ostracism | 6,000-vote threshold to exile a powerful citizen for 10 years. |
| Roman intercessio | Tribunes could veto consular acts; both were elected officials. |
| Modern impeachment / recall | U.S. Constitution Art. II §4; California recall elections; Swiss popular initiatives. |
The pattern: privilege must be contestable through the same machinery used to grant it. The Deviant design's "the same process that admits demotes" is a direct on-chain encoding of this principle.
Vouching admission + bicameral filtering + bidirectional accountability appears repeatedly:
The Deviant voting design is not novel in its primitives. It is a careful recombination of these well-tested patterns into on-chain machinery. The novel parts are the combination and the encoding — putting it all in a covenant rather than in a parliament.
Across ten alternatives that have been deployed at meaningful scale, on five axes:
| System | Sybil resistance | Anti-coordination | Anti-bribery | Cost to capture |
|---|---|---|---|---|
| Token-weighted DAO (Uniswap, Compound, MakerDAO) | None | Low (whales coordinate) | Low (vote markets exist) | Linear in % of token supply |
| Quadratic voting (Gitcoin) | Moderate | Reduced | Possible | Sublinear vs raw stake |
| Optimistic / off-chain (Snapshot) | Same as token-weighted | Same | Same | Same |
| Liquid democracy (Aragon) | Moderate | Influencer-vulnerable | Bribe-an-influencer scales | Top-N delegates |
| KYC + 1p1v | High (if KYC robust) | High | Moderate | KYC compromise + bribery |
| Worldcoin (PoP) | High once enrolled | High | Bounded | Orb compromise / enrollment fraud |
| BrightID | Moderate | Moderate | Bribe nodes | Patient graph farming |
| Proof of Humanity | Moderate | Moderate | Bribe to not challenge | Deposit + uncontested window |
| Snapshot-at-height token voting (Curve veCRV) | Low | Reduced (no flash loans) | Possible | Patient capital accumulation |
| Bicameral sortition (Deviant) | High | Very high | Very high | Multi-dimensional |
Pure capital-based systems have linear or sub-linear cost-to-capture in capital alone — an attacker with enough money wins, and the cost is bounded and computable from market cap. Identity-based systems raise the cost to forge identities, but once identities are forged, the system collapses to whoever controls them. Bicameral sortition is alone in requiring capital AND social-network penetration AND time AND no-detection-by-Elders, simultaneously. An attacker must defeat multiple independent defences in parallel — the costs combine multiplicatively. That is what "substantially stronger" actually means.
Four attack scenarios. Cost estimates are order-of-magnitude only; the point is relative cost across systems.
| System | Cost |
|---|---|
| Token-weighted DAO (mid-cap $100M FDV) | ~$51M, days |
| Quadratic voting | ~$10M, days |
| KYC + 1p1v | Forge ~51% of identities — years |
| Worldcoin | Mass enrollment / orb compromise — years |
| Bicameral sortition | Effectively impossible by capital alone. Sortition randomness can't be bought; pay-regardless defangs bribery; capital does nothing except pay application fees (which go to vouchers anyway). |
The vouching requirement is the killer for the bicameral system. Each sybil needs 15 friend signatures from existing Citizens (pre-gate — rate-limited by real social bandwidth) + 15 yes from 29 random Citizens (sortition luck) + 15 yes from 29 random Delegated Members (second sortition luck) + fee + passing both 29-caps. Three independent filters; sybil count is limited by the real social graph × probability × probability, not by capital.
A determined attacker builds a sybil network over years, each one vouched in legitimately. The defences are recertification (must remain active or be flushed), Elder escalation (cluster of complaints triggers Elder review), lazy-voter detection (pattern analysis flags reflex approvals), rising fees (as the network matures).
Concrete estimate: to control 51% of a 1,000-member Delegated pool, an attacker needs ~500 active sybils. Each sybil costs (estimated, at mature scale):
Rough order of magnitude: $millions/year over many years, with declining survival probability. Compare with the BTC/BCH hashwar's months and ~$100M–$1B for a successful capture — bicameral sortition is at least an order of magnitude more expensive and takes 10× longer, with much higher detection risk per dollar spent.
Rising cost per complaint per accuser (geometric escalation) bounds grinding. Profile-shuffling attacks (many accusers, each one complaint) trigger Elder escalation. The demotion itself uses sortition — the attacker can't pre-arrange who will judge.
The adaptive defences kick in at mature scale. During phases 0–2 (N < 200), founder integrity is the load-bearing trust assumption. No covenant-level mechanism can self-validate the genesis cohort — by definition, the people setting up the system can't be vouched-for by a system that doesn't yet exist.
The bootstrap playbook bounds this externally via published founding documents the community evaluates before opting in:
If any of these are missing or under founder control, the bootstrap is not externally auditable. The asymmetric trust during bootstrap is paid for by asymmetric transparency.
| Phase | Members | Pre-gate | Each chamber (filter %) | Fee | Elder admission |
|---|---|---|---|---|---|
| 0 — Founder bootstrap | 0 – 99 | n/a | founder + first-class-citizen single-sig grants (viral) | free | n/a |
| 1 | 100 – 199 | 1 | 1 of 2 (50%) | very low | n/a |
| 2 | 200 – 299 | 2 | 2 of 3 (~67%) | low | n/a |
| 3 | 300 – 399 | 3 | 3 of 5 (60%) | low | opens — 3+3 + 1 founder |
| ... | each +100 → +1 conf | ... | filter sweeps 55% → 52% | rising | founder substitute fades as Elder cohort grows |
| 15 — mature | 1500+ | 15 | 15 of 29 (52%) | full | strict 21-mode + Elder unanimous (3/3) |
Formulas: conf = min(15, ceil(memberCount / 100)); cap = max(2, 2·conf − 1); pre-gate = conf; fee = floor(conf · baseFee).
At N=300 the first Elder admissions open with 3+3 + 1 founder confirmation (founder substitutes because no Elders exist yet). As the cohort grows:
The founder is a bounded-trust role — not trustless, but with nine independent damage-limiting checks (seven procedural + two economic, the latter covering both proposer-side and voter-side capture costs) plus a constitutional removal path. Even with all layers, the residual is named precisely.
| # | Layer | Mechanism |
|---|---|---|
| 1 | Multi-sig founder | K-of-N multi-signature (e.g., 3-of-5) + voluntary key rotation |
| 2 | Bounded action scope | Founder powers explicitly enumerated in the contract — bootstrap grants + emergency freeze; cannot draw treasury or change parameters |
| 3 | Pre-action announcement | Founder actions announced but not executed for ~1 week; community has window to react |
| 4 | Elder freeze | Quorum of Elders can freeze any pending founder action; frozen actions go to community vote |
| 5 | Elevated demotion path | Strict 21-attempt mode (~71% support) in both random chambers, plus Elder unanimous (3/3) confirmation. Constitutional removal — single dissenting Elder blocks |
| 6 | Confession requirement | Every founder action includes publicly-readable rationale |
| 7 | On-chain action log | All actions queryable forever; reputation-cost mechanism |
| 8 | Removal-bond economics (proposer side) | bond = base · N · log₂(N) · rankMultiplier (Static-MBA-denominated; rank ∈ {1×, 10×, 100×, 1000×} for Citizen / Delegated / Elder / Founder). Two-stage (1% at proposal + 99% at vote-initiation), crowdfunded escrow. On legitimate-recall success: fully refunded to contributors. On attack failure: 30 % to defender + 70 % to protocol treasury (running costs, audits, Elder compensation, infrastructure). Cooldown + 2× doubling per repeat-attempt (capped at 8×). Defends against lone-attacker capture |
| 9 | Per-vote participation fee (voter side) | voteCost = voteBase · √N · log₂(N) · rankMultiplier on elevated paths (Elder rank 1×, Founder rank 10×). Each juror pays at commit time; 100 % to protocol treasury, regardless of vote direction (preserves secret ballot, no vote-with-the-winner gaming, no individual recipient to game). Inverts §6.5: routine voters are paid; constitutional-vote voters pay. Defends against mobilisation-of-many capture — the threat the bond alone cannot price |
Why two economic layers, not one. The bond and the per-vote fee attack different organisational shapes of capture: a lone attacker (or small faction with deep pockets) is priced by the bond, which concentrates cost on the proposer / escrow; a coordinated mobilisation of many cheap voters is priced by the per-vote fee, which distributes cost across the voter set. Together they ensure capture is expensive regardless of how the attacker organises. The bond's curve (N · log₂(N)) and the per-vote fee's curve (√N · log₂(N)) differ because the bond is paid by one party while the per-vote fee is paid by each individual juror — the gentler curve keeps per-juror cost bounded so honest sortitioned voters aren't priced out of constitutional participation.
Worked example at maturity (N = 1 000 000, base units = 1 Static-MBA): attempting Founder removal requires posting 20 billion Static-MBA units as bond and extracts 200 000 units per juror × 30 jurors = 6 million units from the voter set. On failure: 6 B to defender + 14 B to treasury (bond split 30 / 70) + 6 M to treasury (full per-vote pool). On legitimate-recall success: 20 B bond fully refunded to crowdfunded contributors; the 6 M per-vote pool still flows to treasury (collected for the act of participating, not the outcome). Crowdfunded bonds keep per-capita cost affordable for legitimate recalls; per-juror fees keep per-individual cost tractable for engaged community members. Solo-attacker pricing is prohibitive; mobilisation pricing is meaningful. Treasury-routing (revised 2026-06-02 from an earlier burn-on-failure proposal): at these magnitudes, burning would discard working capital that the protocol's running costs absorb productively, and the "defender solicits fake attacks" vector is self-extinguishing — no rational attacker funds a 20 B-unit attack to give 30 % to a defender they're colluding with; the cost magnitude is the protection against that perverse incentive, not the disposal method. At lower N (Phase 0–3) both economic layers are intentionally modest — the procedural layers and published founding documents do the heavy lifting; the economic layers grow into their role as the network matures.
Residual risk, named: a captured founder during their announcement window, with Elders also unresponsive, within bounded scope, could execute one bounded action before the elevated demotion catches up. A state-level actor with ~20 B Static-MBA of loss-tolerance can still force removal at maturity (most of which lands in the protocol treasury and the defender's hands, not destroyed) — the bond raises cost without making capture impossible; the procedural layers (Elder unanimous, strict mode) remain the last line. Bounded damage on bounded actions — qualitatively different from "unbounded permanent backdoor."
Any voting system anchored in a purchasable resource ultimately ranks by capital, however meritocratic the surface looks. The BTC/BCH hashwar (November 2018) is the canonical case:
In the Deviant asset taxonomy, USDT is NBA / MTU — non-backed by the consensus-backing test, with the backing claim sitting off-chain and unenforceable. A failure-mode-of-soft-backing became a vote-rigging tool because the system underneath it (Bitcoin) had no defense against capital generated outside its own rules. The plutocracy attack and the soft-backing failure are the same shape from different angles.
The only way out is to anchor voting weight to something money cannot directly buy: personhood verification, past-time-weighted commitment, reputation graphs, social attestation. Each is a trade-off; the bicameral sortition design layers them deliberately so an attacker must defeat all axes in parallel.
Two residuals worth being explicit about:
That said: the cumulative argument is that bicameral sortition is qualitatively harder to capture than any system deployed at meaningful scale to date. Not because any single mechanism is magic — each individual axis has a known attack — but because the combination forces an attacker to defeat multiple independent defences in parallel, with the cost of each axis rising independently as the network matures.
The framework's primitives (PollCovenant, TallyState, StakeVoteTote) are validated on the BCH chipnet. The full bicameral sortition assembly is design-complete, with a staged implementation roadmap (Phases A → G). No deployment has used this framework yet; this document is the public reference for analysts evaluating it before any real launch.
Full technical materials (the wiki references):
wiki/voting-systems.md — the design doc.wiki/voting-systems-bootstrap-playbook.md — the operational playbook.wiki/decisions.md — ADR-0040 (decision record + addenda 1–6).wiki/asset-landscape.md — the asset taxonomy referenced in §9.