The Hall under issuer pressure.

Two runs of the same eight scenarios

On devnet, with signatures In a local simulator Cost table

Run on devnet

Public devnet transactions against mock issuers. This records the program, not a real issuer's behaviour.

What produced this run

Recorded by the devnet cluster. Solana devnet, a public test cluster. Every signature below can be looked up on any Solana devnet explorer. Program 4wmfRdQguyhGCvZe4FXHo7Kpx5aWbRBHPBbs8k6XRjDx.

8 scenarios. Each one names who acted, what they did, whether it worked, the reason when it did not, and the state of the alloy afterwards. Amounts are whole token units.

Jump to

Founding an alloy and striking shares A dividend paid as new tokens vests instead of arriving at once A melt succeeds while the issuer has frozen a constituent A paused constituent cannot stop a melt A seizure is shared between holders and claimants Sending tokens to the Hall does not move the price of a share A constituent that takes a transfer fee is refused A constituent whose new accounts start frozen is refused

Founding an alloy and striking shares

Anyone can found an alloy without asking Seametry, on real Token-2022 mints an independent mock issuer controls. A second wallet strikes an exact number of shares.

Who	What	Result	Transaction	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
sponsor	initialize_alloy with 5,000,000 of A and 3,000,000 of B, and 1,000,000 genesis shares locked	succeeded	`XP6t4Da5`	5,005,000, 0, 0	1,000, 0, 0
holder	strike 1,000 shares	succeeded	`n142CEzD`	5,005,000, 0, 0	1,000, 0, 0

What this does not show

Whether anyone will hold these shares, or what the shares trade for. The Hall has no price and this run has no market.

A dividend paid as new tokens vests instead of arriving at once

Tokens the issuer mints into the Hall are recorded as pending. They reach the ledger in a straight line over one hour, so a payment cannot change what a share is worth in a single block. This run does not wait out the vest: seeing pending rise and the ledger hold is the demonstration.

Who	What	Result	Transaction	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
issuer	mint 500,000 of A into the Hall's account, a dividend paid as new tokens	succeeded	`3gNpzVyJ`	5,005,000, 500,000, 0	1,000, 0, 0
anyone	sync leg A	succeeded	`3BajPQjB`	5,005,000, 500,000, 0	1,000, 0, 0

What this does not show

How any real issuer pays a dividend. Backpack's mechanism is unconfirmed, and xStocks reinvests through a multiplier that changes no balance, which this run does not exercise. The vest window is compiled into the program as 3600 seconds; nobody waited that long for this run.

A melt succeeds while the issuer has frozen a constituent

The issuer freezes the Hall's account for A on chain. A new strike is refused. A melt still succeeds, because it moves no constituent. B delivers, the claim on A is refused while frozen, and it delivers once the issuer thaws the account.

Who	What	Result	Transaction	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
issuer	freeze the Hall's account for A	succeeded	`2T1Gza2m`	5,003,000, 0, 0	600, 0, 0
holder	strike 10 shares	refused `HallAccountFrozen`	Never reached a block	5,003,000, 0, 0	600, 0, 0
holder	melt 400 shares	succeeded	`TaLVQoHR`	5,003,000, 0, 0	600, 0, 0
holder	withdraw the whole claim on B	succeeded	`3Y2kKPZY`	5,003,000, 0, 0	600, 0, 0
holder	withdraw the whole claim on A	refused `Account is frozen`	Never reached a block	5,003,000, 0, 0	600, 0, 0
issuer	thaw the Hall's account for A	succeeded	`2rxNKGeL`	5,003,000, 0, 0	600, 0, 0
holder	withdraw the whole claim on A	succeeded	`62Rpocun`	5,003,000, 0, 0	600, 0, 0

What this does not show

That every issuer behaves like this one. This issuer is a mock, controlled by this run, that reproduces the extension set reported for xStocks.

A paused constituent cannot stop a melt

A pause stops every transfer of A everywhere. The melt still succeeds and the claim on A waits until the issuer resumes.

Who	What	Result	Transaction	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
issuer	pause A everywhere	succeeded	`284G8DyB`	5,003,000, 0, 0	600, 0, 1,200
holder	melt 400 shares	succeeded	`2TCbDt3f`	5,003,000, 0, 0	600, 0, 1,200
holder	withdraw the whole claim on A	refused `Transferring, minting, and burning is paused on this mint`	Never reached a block	5,003,000, 0, 0	600, 0, 1,200
issuer	resume A	succeeded	`2cLEHKjy`	5,003,000, 0, 0	600, 0, 1,200
holder	withdraw the whole claim on A	succeeded	`5Uw3g4Nr`	5,003,000, 0, 0	600, 0, 1,200

What this does not show

How long an issuer may keep a constituent paused. The Hall states the delay and cannot end it.

A seizure is shared between holders and claimants

The issuer takes tokens out of the Hall with its permanent delegate. The next sync applies the loss to the ledger and to unclaimed in proportion.

Who	What	Result	Transaction	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
holder	melt 400 shares	succeeded	`2PPHTuxb`	3,001,800, 0, 1,200	600, 1,199, 1,200
issuer	take two fifths of A out of the Hall with its permanent delegate	succeeded	`31uGiEMz`	3,001,800, 0, 1,200	600, 1,199, 1,200
anyone	sync leg A	succeeded	`3uxfdvCR`	3,001,800, 0, 1,200	600, 1,199, 1,200

What this does not show

Whether the issuer would do this, or under what authority. The Hall records that it happened and who bore it.

Sending tokens to the Hall does not move the price of a share

A raw transfer to the Hall is recorded as pending, not added to the ledger, so what a share is worth does not change at once. The sender holds no shares and cannot take the tokens back.

Who	What	Result	Transaction	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
attacker	send 9,000,000 of A straight to the Hall, holding no shares	succeeded	`2st3H8ix`	5,005,000, 9,000,000, 0	1,000, 0, 0
anyone	sync leg A	succeeded	`4YRghYfk`	5,005,000, 9,000,000, 0	1,000, 0, 0

What this does not show

That no attack exists. This shows the one used against vaults that price shares by ratio, and the vesting rule that answers it.

A constituent that takes a transfer fee is refused

A fee on transfer would make the Hall record units it never received, so the alloy is refused at founding, with the reason.

Who	What	Result	Transaction	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
sponsor	initialize_alloy with a constituent that takes a 1 percent transfer fee	refused `DepositNotReceivedInFull`	Never reached a block	No alloy exists, because the founding was refused.

What this does not show

Whether some other treatment of such a constituent would be sound. This is the refusal the program makes, and the reason it gives.

A constituent whose new accounts start frozen is refused

The Hall's account for such a constituent would begin frozen, so the alloy is refused instead of being created unable to move it.

Who	What	Result	Transaction	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
sponsor	initialize_alloy with a constituent whose new accounts start frozen	refused `HallAccountFrozen`	Never reached a block	No alloy exists, because the founding was refused.

What this does not show

Whether some other treatment of such a constituent would be sound. This is the refusal the program makes, and the reason it gives.

Not shown at all in this run

A change of the Scaled UI multiplier. Its initializer takes a floating point number and this repository allows none. The Hall never reads a multiplier.
A dividend's vest completing: the vest window is compiled into the program and nobody waited it out for this run.
The upgrade authority as a live control: it is not exercised in this run.

Run in a local simulator

What produced this run

Recorded by a local simulator, not a cluster. A local simulator running the compiled program and the real Token-2022 program. Nothing here was sent to a cluster. Program 4wmfRdQguyhGCvZe4FXHo7Kpx5aWbRBHPBbs8k6XRjDx. No transaction signatures exist for these steps, so none is shown.

8 scenarios. Each one names who acted, what they did, whether it worked, the reason when it did not, and the state of the alloy afterwards. Amounts are whole token units.

Jump to

Founding an alloy and striking shares

Anyone can found an alloy without asking Seametry. The genesis shares are held by an account the program cannot move from, and a second wallet strikes an exact number of shares, paying the amounts the Hall computes and rounds up.

Who	What	Result	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
sponsor	initialize_alloy with 5,000,000 of A and 3,000,000 of B, and 1,000,000 genesis shares locked	succeeded	5,000,000, 0, 0	0, 0, 0
holder	strike 1,000 shares	succeeded	5,005,000, 0, 0	1,000, 0, 0

What this does not show

Whether anyone will hold these shares, or what the shares trade for. The Hall has no price and this run has no market.

A dividend paid as new tokens vests instead of arriving at once

Tokens the issuer mints into the Hall are recorded as pending. They reach the ledger in a straight line over one hour, so a payment cannot change what a share is worth in a single block. Once the ledger per share is not a whole number, a strike takes the rounded up amount and a melt returns the rounded down amount, and the difference stays with the Hall.

Who	What	Result	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
issuer	mint 500,000 of A into the Hall's account, a dividend paid as new tokens	succeeded	5,005,000, 0, 0	1,000, 0, 0
anyone	sync leg A	succeeded	5,005,000, 500,000, 0	1,000, 0, 0
anyone	sync leg A, half an hour later	succeeded	5,255,000, 250,000, 0	1,000, 0, 0
holder	strike 7 shares	succeeded	5,255,037, 250,000, 0	1,007, 0, 0
holder	melt 7 shares	succeeded	5,255,001, 250,000, 36	1,000, 36, 21

What this does not show

How any real issuer pays a dividend. Backpack's mechanism is unconfirmed, and xStocks reinvests through a multiplier that changes no balance, which this run does not exercise.

A melt succeeds while the issuer has frozen a constituent

The issuer freezes the Hall's account for A. A new strike is refused, because the Hall cannot take A in. A melt still succeeds, because it moves no constituent. B is delivered, the claim on A is refused while frozen and stays exactly as it was, and it is delivered once the issuer thaws the account.

Who	What	Result	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
issuer	freeze the Hall's account for A	succeeded	5,005,000, 0, 0	1,000, 0, 0
holder	strike 10 shares	refused `HallAccountFrozen`	5,005,000, 0, 0	1,000, 0, 0
holder	melt 400 shares	succeeded	5,003,000, 0, 2,000	600, 2,000, 1,200
holder	withdraw the whole claim on B	succeeded	5,003,000, 0, 2,000	600, 2,000, 0
holder	withdraw the whole claim on A	refused `Account is frozen`	5,003,000, 0, 2,000	600, 2,000, 0
issuer	thaw the Hall's account for A	succeeded	5,003,000, 0, 2,000	600, 2,000, 0
holder	withdraw the whole claim on A	succeeded	5,003,000, 0, 0	600, 0, 0

What this does not show

That every issuer behaves like this one. This issuer is a mock that reproduces the extension set reported for xStocks, run in a simulator.

A paused constituent cannot stop a melt

A pause stops every transfer of A. The melt still succeeds and the claim on A waits until the issuer resumes.

Who	What	Result	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
issuer	pause A everywhere	succeeded	5,005,000, 0, 0	1,000, 0, 0
holder	melt 400 shares	succeeded	5,003,000, 0, 2,000	600, 2,000, 1,200
holder	withdraw the whole claim on A	refused `MintPaused (raised by Token-2022)`	5,003,000, 0, 2,000	600, 2,000, 1,200
issuer	resume A	succeeded	5,003,000, 0, 2,000	600, 2,000, 1,200
holder	withdraw the whole claim on A	succeeded	5,003,000, 0, 0	600, 0, 1,200

What this does not show

How long an issuer may keep a constituent paused. The Hall states the delay and cannot end it.

A seizure is shared between holders and claimants

The issuer takes tokens out of the Hall. The next sync notices the balance fell and applies the loss to the ledger and to unclaimed in proportion. A melt that has not yet been withdrawn shrinks with it.

Who	What	Result	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
holder	melt 400 shares	succeeded	5,003,000, 0, 2,000	600, 2,000, 1,200
issuer	take two fifths of A out of the Hall with its permanent delegate	succeeded	5,003,000, 0, 2,000	600, 2,000, 1,200
anyone	sync leg A	succeeded	3,001,800, 0, 1,200	600, 1,199, 1,200

What this does not show

Whether the issuer would do this, or under what authority. The Hall records that it happened and who bore it.

Sending tokens to the Hall does not move the price of a share

A raw transfer to the Hall is recorded as pending, not added to the ledger, so what a share is worth does not change at once. The sender holds no shares and cannot take the tokens back.

Who	What	Result	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
attacker	send 9,000,000 of A straight to the Hall, holding no shares	succeeded	5,005,000, 0, 0	1,000, 0, 0
anyone	sync leg A	succeeded	5,005,000, 9,000,000, 0	1,000, 0, 0

What this does not show

That no attack exists. This shows the one used against vaults that price shares by ratio, and the vesting rule that answers it.

A constituent that takes a transfer fee is refused

A fee on transfer would make the Hall record units it never received, so the alloy is refused at founding, with the reason.

Who	What	Result	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
sponsor	initialize_alloy with a constituent that takes a 1 percent transfer fee	refused `DepositNotReceivedInFull`	No alloy exists, because the founding was refused.

What this does not show

Whether some other treatment of such a constituent would be sound. This is the refusal the program makes, and the reason it gives.

A constituent whose new accounts start frozen is refused

The Hall's account for such a constituent would begin frozen, so the alloy is refused instead of being created unable to move it.

Who	What	Result	Leg A: ledger, pending, unclaimed	Holder: shares, claim on A, claim on B
sponsor	initialize_alloy with a constituent whose new accounts start frozen	refused `HallAccountFrozen`	No alloy exists, because the founding was refused.

What this does not show

Whether some other treatment of such a constituent would be sound. This is the refusal the program makes, and the reason it gives.

Not shown at all in this run

A change of the Scaled UI multiplier. Its initializer takes a floating point number and this repository allows none. The Hall never reads a multiplier.
The upgrade authority. A simulator has none to show.
A run on mainnet. The devnet run is recorded separately, above.

What a strike costs and what a melt returns

Computed by the Go engine from the alloy as the simulator's dividend scenario leaves it: 1,001,000 shares outstanding, holding 5,255,001 of A and 3,003,000 of B in its ledger. A strike takes the rounded up amount and a melt returns the rounded down amount, so whatever is left over stays with the Hall.

Shares	Strike takes A	Strike takes B	Melt returns A	Melt returns B	Hall keeps A
1	6	3	5	3	1
7	37	21	36	21	1
100	525	300	524	300	1
1,000	5,250	3,000	5,249	3,000	1
12,345	64,809	37,035	64,808	37,035	1

What this does not show

A price. The Hall reads none, so nothing here says what a share is worth or trades for. Comparing a share's price with the cost of assembling it is the Terminal's job, and the Terminal is not built.