Decentralized Commerce Simulator

Nikolaj I. Schwartzbach

This widget simulates multiple trades between a buyer and a seller who deploy the smart contract for provably secure decentralized commerce described in (Schwartzbach, 2021). The contract holds the payment in escrow and allows both parties to submit a wager of size λ that they can convince a third party of their honesty. The loser loses their deposit. The arbiter is only invoked in case of disputes and does not control the escrow. The contract is shown to be secure whenever the arbiter is strictly biased in favor of the honest party. Specifically, if γ is the error rate of the arbiter, we need that γ<0.5 to ensure security.

Informally, security means that parties lose money in the long run by misbehaving. Formally, security means the honest strategy profile is a subgame perfect equilibrium with the additional property that any dishonest pure strategy yields an expected loss of ε utility for the deviating party. Here, ε is a constant that is maximized when possible, or when unbounded we minimize it with respect to the bounds in Theorem 3.

The contract proceeds as follows:
  1. The buyer and the seller sign a document committing to trading the item.
  2. The buyer transfers x to the smart contract.
  3. The seller delivers the item to the buyer "off-chain" and notifies the smart contract.
  4. The buyer either a) accepts the delivery; or b) makes a disputing by depositing an additional λ money to the smart contract.
  5. If the buyer accepts, the money is transfered to the seller and the contract terminated.
  6. If the buyer disputes, the seller can either a) forfeit the dispute, giving all money to the buyer; or b) counter the dispute by also making a wager of size λ that they were honest.
  7. If the seller counters the dispute, the arbiter is invoked who determines a winner. The winner is sent x+αλ money while the loser receives nothing.
Note that the contract is parameterized by the rebate coefficient α that determines how much of the wager is held by the arbiter. If α=0 the arbiter keeps all wagers, while if α=2 it keeps nothing.
Trade amount x =  µ₿
Value to buyer y =  µ₿ Value to seller x'=  µ₿
Arbiter error γ =  % Rebate amount α =


The contract has been implemented in Solidity and can be found at the following link: The contract is implemented as a persistent seller to amortize the transaction fees. It uses the coin flip arbiter with γ=0.5 for simplicity which means the contract has weak game-theoretic security, i.e. ε=0. The contract has not been formally verified and should only be used for research purposes.


Department of Computer Science. Aarhus University