Skip to main content

Architecture

OMY is a small set of cooperating Tolk contracts. The design follows the optimistic-oracle separation of concerns: one immutable assertion per question, a pluggable resolver for dispute settlement, a factory that spawns the right Storage layout, and a generic consumer callback.

Contract topology​

 ┌─────────────────┐
 consumer ──► │ OracleFactory │ ──spawn──► Assertion (one per question)
 └────────┬────────┘ │
 │ │ on dispute:
 │ injects ▼
 monetization snapshot ┌──────────────────┐
 into each Assertion │ Resolver │
 │ (Phase 1 = M-of-N│
 │ committee. │
 │ Phase 2 = DVM │
 │ staked $OMY │
 │ vote) │
 └──────────────────┘

The contracts​

OracleFactory​

The single deployer of new Assertions. Holds the bond-jetton master address (USDT on mainnet), the wallet-discovery TEP-89 plumbing, and the monetization snapshot (final fee + treasury address). Owner can update monetization via a governance switch — affecting future assertions only; already-deployed ones are immune by design (snapshot is immutable in their Config).

Assertion​

One contract per question. Holds:

  • Immutable config: question id, creator, resolver, bond amount, liveness window, metadata, monetization snapshot.
  • Mutable state: status (Open → Proposed → Disputed/Resolved/Cancelled), proposer and disputer addresses, bond amounts, deadline.

Lifecycle:

  1. Open — nobody has proposed yet.
  2. propose — anyone posts bondAmount + protocolFee jettons. Status → Proposed, deadline = now + liveness.
  3. finalize — after deadline, if no dispute, anyone can call. Status → Resolved. Proposer gets bond back. Fee stays in treasury.
  4. dispute — within the window, anyone can post bondAmount jettons to challenge. Status → Disputed. Resolver opens a case.
  5. Resolve — sent by the resolver after the case decides. Status → Resolved. Winner gets own bond + half of loser bond; treasury gets half.
  6. TimeoutRefund — after the arbitration window without a resolution, anyone can cancel. Status → Cancelled. Both bonds refunded; fee already burned at propose.

Resolver — Phase 1: CommitteeResolver​

M-of-N multisig of trusted signers. At launch: 3-5 reputable TON-ecosystem signers. Fast, safe at low TVL, centralized. Same interface as the Phase 2 resolver — consumers don't need to change anything when we upgrade.

Resolver — Phase 2: StakeVoteResolver (DVM)​

Stake-weighted commit-reveal voting in $OMY. Each disputed assertion opens a case; stakers commit a vote weight (escrowing $OMY), reveal in the next window, and slashing/rewards are computed from the escrowed pot. Already implemented (escrow + slash math conserved) — kept in reserve until $OMY has real value.

Market (first dogfooded consumer)​

A prediction market: split-and-merge of USDT → YES/NO outcome shares, a constant-product AMM (buy YES / buy NO), oracle-driven resolution, redeem at $0.99/share (1% silent skim to treasury). The reference integrator pattern for any future consumer.

TON-specific constraints honored​

  • No cron — TON has no scheduled execution. finalize requires an off-chain keeper to send the message after the window. The contract only checks now() >= deadline.
  • Async actor model — no synchronous cross-contract reads. Settlement happens via messages, not view calls.
  • Bond/gas separation — bonds are USDT-like jettons; the contract holds them in its own jetton wallet. TON balance is reserved for gas (GAS_RESERVE = 0.2 TON) and never touched by bond accounting.
  • TEP-89 wallet discovery — works for any jetton including real USDT, not just our test jetton. Production-correct.
  • Replay protection — status guards make every transition fire exactly once. ReemitResult redelivers callbacks idempotently for at-least-once delivery (consumers must dedupe by questionId, see SDK guide).

The economic flywheel​

  • Bonds must exceed the profit from lying. The Market clamps the oracle bond to 2% of TVL at resolution time, floored at the configured minimum and capped at MAX_BOND_CAP = 10 000 USDT.
  • Final fee (2 USDT in Phase A) accrues to treasury on every propose. Dispute treasury cut (50% of loser bond) accrues on every disputed resolution. AMM swap fees (0.5%) accrue on every YES/NO trade. Resolution skim (1% silent) accrues at market resolve.
  • In Phase B (post-$OMY), all treasury inflows route 50/50 between protocol treasury and staked-$OMY holders via a RewardsDistributor contract. This gives $OMY its cash flow → price floor → security budget for the DVM.

What's deliberately not here​

  • No upgrade hooks. Contracts are immutable by design. Bug fixes ship as v2 contracts at new addresses; users migrate. Simpler attack surface vs. ETH proxy patterns.
  • No fee config per-call. Consumer sees one bond, one fee — both come from the assertion's snapshot at spawn time. Predictable and transparent.
  • No oracle marketplace. Single resolver per assertion, picked by the consumer. Composition over choice.

Going deeper​