Rider
Proof · Arc mainnet, chain 5042

Every transaction, including the ones the contracts refused.

The proof run, in the order it was sent. Each row prints what was expected next to what happened, and links to the explorer so you can check it yourself.

Transactions
30
Mined as intended
22
Refused as intended
8
Matched expectation
30/30
Contracts verified
15

Seeding

Underwriting capital in, the drill accounts funded, the canary vault seeded, and one underwriter exit queued so its cooldown could be tested.

  1. 01
    Underwriter approves the Rider USDC pool
    block 25,803,438gas 55,438
    mined0xa4e62345…a55629 ↗
  2. 02
    Underwriter deposits into the Rider USDC pool
    block 25,803,440gas 362,987
    mined0xc76614f0…9b6d17 ↗
  3. 03
    Underwriter approves the drill pool
    block 25,803,449gas 55,438
    mined0x68200ff7…8ddf24 ↗
  4. 04
    Underwriter deposits into the drill pool
    block 25,803,458gas 143,139
    mined0x3ca5b300…7e3c13 ↗
  5. 05
    Fund the drill relayer
    block 25,803,460gas 73,950
    mined0xe34f683f…11b902 ↗
  6. 06
    Fund the demo policyholder
    block 25,803,469gas 73,950
    mined0x55d212d5…f2ce1c ↗
  7. 07
    Drill operator approves the canary vault
    block 25,803,471gas 55,438
    mined0x34d520fe…c322f1 ↗
  8. 08
    Drill operator seeds the canary vault
    block 25,803,473gas 102,928
    mined0x0cfd9310…eac0fe ↗
  9. 17
    Underwriter requests a redemption (ERC-7540)
    block 25,803,518gas 99,709
    mined0xb09068fb…acf235 ↗

Real cover on live markets

Cover sold on all four live markets. The first row is a deposit into Galaxy's Morpho vault and its cover in one Multicall3From transaction, with the depositor as the sender of every call.

  1. 09
    Protected deposit: Galaxy USDC vault + cover, one Multicall3From tx
    block 25,803,500gas 790,271
    mined0xa1035312…b4a7bb ↗
  2. 10
    Cover: Keyrock Prime USDC vault drawdown
    block 25,803,502gas 580,195
    mined0x3c851e22…b7c95b ↗
  3. 11
    Cover: EURC peg to the euro
    block 25,803,504gas 560,677
    mined0x50d3cbaa…bc0676 ↗
  4. 12
    Cover: cirBTC reserve backing
    block 25,803,506gas 556,956
    mined0xeaee70ed…feab32 ↗

Refused on-chain

Sent on purpose, expected to revert, and mined as reverted. Each one hit the custom error printed next to it.

  1. 13
    Refused: cover beyond the market's capacityCapacityExceeded(1000000, 500000)Asked for 1.00 USDC of cover; the market could back 0.50 USDC more.
    block 25,803,508gas 171,486
    refused0x00078c7d…8de8da ↗
  2. 14
    Refused: premium above the buyer's limitPremiumAboveMax(606, 0)The premium came to 0.000606 USDC, above the buyer's limit of 0.00 USDC.
    block 25,803,510gas 219,777
    refused0xcd8d8506…f0b578 ↗
  3. 15
    Refused: incident on a healthy readingNotFiring(0)The trigger read a 0.00% loss, below its line. There was nothing to open.
    block 25,803,512gas 87,639
    refused0x430603b9…cf1598 ↗
  4. 16
    Refused: claim with no incidentWrongStatus(0)The market was active. Claims exist only after a confirmed incident.
    block 25,803,516gas 24,253
    refused0x1c4856e4…df52c3 ↗
  5. 18
    Refused: redemption before the cooldownNotClaimable(50000000000, 0)None of the requested shares were past the 3-day cooldown.
    block 25,803,520gas 299,518
    refused0x3107a47f…97cc27 ↗
  6. 20
    Refused: outsider buys cover on the drill marketBuyerNotAllowed(0x73c37EF65789B50511656F3ec4F22E21FFddc549)The drill market sells only to its drill runner; this address is not it.
    block 25,803,560gas 35,183
    refused0x2d1af97b…13a072 ↗
  7. 22
    Refused: cover on a burning houseTriggerFiring(2000)The canary already read a 20.00% loss. No cover is sold on a burning house.
    block 25,803,565gas 58,355
    refused0x5d9aa379…a8309d ↗
  8. 25
    Refused: underwriter exit while an incident is openPoolFrozen()Exits close while an incident is open, so no underwriter leaves ahead of a loss.
    block 25,803,572gas 59,931
    refused0xcacfe224…6206d2 ↗

Live drill

The whole claims path on the canary market: buy, break, open, confirm, pay, settle, repair, rearm. An underwriter's exit during the open incident is refused in the same run.

  1. 19
    Drill: buy canary cover (approve + buy, one Multicall3From tx)
    block 25,803,551gas 452,872
    mined0x4588fea0…329c24 ↗
  2. 21
    Drill: break the canary vault (-20%)
    block 25,803,563gas 58,330
    mined0xc0b9a03a…5c6e37 ↗
  3. 23
    Drill: open incident
    block 25,803,568gas 171,345
    mined0xb73f9be0…094345 ↗
  4. 24
    Drill-pool underwriter queues an exit during the incident
    block 25,803,570gas 99,709
    mined0x3a29f0fd…d62d1b ↗
  5. 26
    Drill: confirm incident after the delay
    block 25,803,630gas 89,962
    mined0x995ec5ad…4c0856 ↗
  6. 27
    Drill: pay the policyholder
    block 25,803,633gas 159,649
    mined0xf3aba7fb…a11474 ↗
  7. 28
    Drill: settle and retire the round
    block 25,803,811gas 82,100
    mined0x2bb91c51…f9c50c ↗
  8. 29
    Drill: repair the canary vault
    block 25,803,820gas 78,400
    mined0xb974bc77…e31631 ↗
  9. 30
    Drill: rearm the market
    block 25,803,831gas 53,135
    mined0x37531e96…128381 ↗

Contracts

All 15 contracts are verified on Sourcify, so the source behind every address can be read and recompiled. The contracts are immutable: there is no proxy and no upgrade path.

Tested

Foundry tests in the repository. The fork tests run against live Arc mainnet state through Arc Foundry.

An independent review found 2 high and 5 medium issues before deployment. Each was fixed with a regression test, except caller-chosen sampling, which cannot be closed in code and is mitigated and listed below.

Honest limits

What Rider does not claim, so nobody has to guess.

  1. One key owns the protocol during the grant period.

    It can pause sales and add markets. A new market waits a 4-day notice before it can sell, longer than the 3-day underwriter exit, so an underwriter who objects can leave first. It can never block a claim or move pool funds.

  2. Callers choose when incidents are sampled.

    Anyone may open and resolve an incident, so the two moments the trigger is read are picked by whoever calls. The confirmation delay and pricing claims at the healthier of the two readings limit that freedom; they do not remove it.

  3. The canary is controlled by Rider.

    The paid claim on mainnet is on a vault Rider breaks on purpose. No live market has fired yet.

  4. A quiet feed stops, it does not pay.

    Chainlink feeds on Arc have a 24-hour heartbeat. A stale feed closes sales and incidents rather than paying; a real depeg during a feed outage is not claimable until the feed resumes.

  5. Pool capital is small.

    The pools hold what was needed to prove the mechanism: 1.50 USDC of underwriting and 0.50 USDC in the drill pool at seeding.

  6. Reviewed, not audited; experimental, not insurance.

    The contracts had an independent adversarial review, not a professional audit. Rider pays parametric cover by code; it is not a regulated insurance contract.

Run the claims path yourselfSource on GitLab