Economic Design Audit

ECONOMIC_DESIGN_AUDIT Skill (DAML)

Trigger Pattern: MONETARY_PARAMETER flag (required) Inject Into: Breadth agents (merged via M4 hierarchy) Finding prefix: [DML-EDA-N] Rules referenced: R2, R10, R13, R14

rate|fee|reward_rate|emission|inflation|cap|limit|max_amount|basis_points|bps|fee_bps|spread|price|amount

DAML arithmetic context: monetary values are template fields typed Int or Decimal (Decimal = fixed-point, 10 fractional digits). There is no floating-point. A "setter" is a choice that archives a config/parameter contract and creates a successor with a changed field; a "consumer" is any choice/ensure that reads that field and branches. Critical DAML difference: Int/Decimal THROW on overflow — they do not wrap. So an economic boundary that overflows is a liveness/brick bug (the choice aborts, the path becomes un-exercisable), never a silent-value bug. Division truncates toward zero.

1. Parameter Boundary Analysis

For every monetary parameter (a config/parameter template field set by a choice — rate, fee, reward rate, emission, cap, floor, BPS):

For each: substitute min and max into ALL consuming choices. Tag: [BOUNDARY:param=val -> outcome]

DAML-specific boundary checks:

• Does MAX cause an Int/Decimal overflow in amount * rate BEFORE the division? An overflow ABORTS the choice → liveness brick ([ELEVATE:ENSURE_GAP]/boundary), not a wrap.
• Does 0 cause a division-by-zero? In DAML that ABORTS the transaction → verify a guard or ensure blocks zero.
• Does 10000 bps (100%) make the holder receive 0 (truncated) or, with fees-on-fees, push a successor's ensure to fail (PreconditionFailed)?
• Does a negative field value slip past a missing ensure? (Int/Decimal are signed; ensure amount > 0.0 is the only guard.)

2. Economic Invariant Identification

List all economic invariants the protocol must maintain, and whether a setter choice can break them:

For each setter: can creating a successor with a changed field break an invariant a consuming choice depends on? If yes → finding.

DAML-specific invariants:

• Value conservation across split/merge/transfer: total carried by all child contracts must equal the parent. Verify no rounding loss accumulates across many split operations (Decimal truncation).
• No negative amounts: only an ensure amount >= 0.0 prevents a negative-amount contract entering the ACS; without it the create succeeds and every downstream choice trusts a broken invariant.
• Accumulator/cap honored across transactions: see Section 3 — this is the highest-yield DAML economic class.

3. Accumulator / Cap Coherence Across Transactions (R14 — PRIMARY DAML LANE)

DAML has no global mutable counter; a cap/total is itself a contract whose field is updated by a choice. The recurring bug: a value-creating choice does NOT update the accumulator contract, so the cap is never enforced across transactions.

Check (R14 cross-variable + constraint coherence + setter regression):

• Is there a value-creating choice (mint/issue/Propose-Accept) that creates an asset contract but does NOT archive+recreate the cap/total contract to reflect it? → cap unenforced → unbounded issuance ([ELEVATE:VALUE_CONSERVATION]).
• Are two interacting limits (per-tx cap and global cap) settable by independent choices without a coherence check between them?
• Can a setter choice lower the cap field BELOW the already-accumulated total? What does the consuming ensure/guard do then (abort? lock out all holders?) — setter regression.
• Permissionless issuance: if the issuing choice's controller is non-privileged or argument-derived, a holder can inflate issuance past the cap (cross-reference AUTHORIZATION_MODEL).