3/5 Majority Consensus & 7-Day Timeout Refunds

The decentralized drawing architecture of DeSix is driven by DeSixDrawManager.sol. It integrates oracle staking access, a multi-node majority consensus mechanism, a dynamic dispute game, and a timeout automatic refund channel to form a robust, self-healing system of mainnet grade.

---

1. Oracle 3/5 Consensus Mechanism

DeSix currently configures a set of Trusted Oracles run by five independent validators on-chain:

• Staking Admission: When registering, each oracle must provide a minimum stake (Testnet 1,000 USDC of LP shares, Mainnet 5,000 USDC). This stake is automatically slashed (Slash) if malicious behavior is proven.
• Majority Ruling: After betting closes for an issue, nodes independently fetch real-world outcomes and submit them. Once three nodes (a majority out of five) submit the same number, a consensus is reached.
• Decoupled Settlement: To prevent Out-of-Gas errors during high-concurrency periods when thousands of orders are settled at once, DeSix decouples consensus drawing from order settlement. The consensus number is recorded as winningNumber immediately, and the settlement process is advanced asynchronously by a cursor in batches.

---

2. Dynamic Dispute Stakes (getEffectiveDisputeStake)

A winning number that has reached consensus cannot immediately trigger payouts; it must pass a challenge period. During this period, any player or external scavenger who finds that the consensus number differs from the official result can raise a Dispute. To prevent attackers from maliciously locking up large prize pools at zero cost (for instance, using a 10 USDC stake to delay payouts in a 1,000,000 USDC pool via a false challenge), DeSix implements a Dynamic Dispute Stake mechanism:

$$\text{DisputeStake} = \max(\text{minDisputeStake}, \text{Total Stake of Issue} \times 0.5%)$$

• Small Pools: The stake remains at a low default level (Testnet 10 USDC / Mainnet 100 USDC), ensuring a low barrier for ordinary users to protect their rights.
• Large Pools: The stake scales proportionally with the size of the betting pool (with no upper limit). Attackers wishing to disrupt large settlements must pay a very high stake cost, which will be confiscated if they lose.

---

3. Adaptive Dual-Track Challenge Period

The challenge period automatically adapts based on the level of consensus divergence among nodes:

• Fast Challenge Track (30 Minutes): If all five oracle nodes submit unanimous results, showing zero divergence, the challenge period is only 30 minutes. After 30 minutes with no disputes, anyone can trigger finalizeDraw permissionlessly to start payouts.
• Standard Challenge Track (24 Hours): If there is divergence among the five nodes (e.g., three vote for 12, two for 8), showing potential errors, the challenge period automatically extends to 24 hours. This provides ample buffer time for the community to compile cryptographic proofs.

---

4. 7-Day Bounded Timeout Self-Healing (Stuck Exit)

If oracle nodes suffer from widespread network failures, prolonged official site outages, or other force majeure, leaving the system unable to reach consensus more than 7 days after closing, the contract automatically activates the Bounded Timeout Refund Escape Channel:

1. Force Void: Any player can call forceVoidStaleIssue to force the stalled issue into the Voided state.
2. Full Refund (claimRefund): Once voided, all USDC staked in that issue is immediately moved to the refund reserve bucket. Bettors can call claimRefund to recover their principal in full without loss.
3. LP Escape Hatch (emergencyWithdrawLP): In extreme scenarios of suspension or prolonged deadlock, LPs can bypass solvency checks and withdraw their assets via emergencyWithdrawLP, preventing capital from being physically trapped inside the contract.