01 · Mechanism
Turn the promise into an object the group can resolve
A deadline normally lives in a message, a task board, or someone's memory. Enforcement is social and ambiguous: one person claims the work is complete, another disagrees, and nobody knows when the decision is final. Bondline makes the commitment explicit. A creator opens a Bond, states the deliverable and deadline, and escrows MON against it inside a Circle.
The Circle is the adjudicator. Its members know enough context to evaluate the claim, but no single member controls the outcome. A configurable approval threshold converts their Cosigns into a group verdict. The stake gives that verdict economic weight without pretending a smart contract can inspect whether a design, milestone, or side project is genuinely finished.
02 · Primitives
Four concepts carry the whole protocol
A Circle fixes the member set and approval threshold. A Bond holds the creator's description, deadline, evidence commitment, voting window, and MON stake. A Cosign is a member's yes-or-no judgment after the creator declares success. The Pot is the Circle's isolated balance of forfeited stakes.
These names are product language, but they also map cleanly onto contract responsibilities. BondlineCore owns Bond escrow and resolution. Each Circle is an EIP-1167 clone with its own membership, threshold, and Pot. CircleFactory deploys and indexes those clones, while pure threshold math is shared between Bond and payout decisions.
Create the group, fixed members, and approval threshold.
Describe the commitment, set a deadline, and escrow MON.
Claim completion before the deadline and bind the evidence hash.
Eligible Circle members approve or reject the claim.
Refund the creator or forfeit the stake into the Circle Pot.
Members use the same threshold to approve a Pot payout.
03 · Thresholds
The creator cannot vote on their own Bond
Bondline stores thresholds in basis points and rounds required approvals upward. For Bond resolution, eligible voters are the Circle members excluding the Bond creator. For a Pot payout, every Circle member is eligible because there is no personal success claim to self-approve.
Ceiling division is important. A 50% threshold among three eligible voters should require two approvals, not one. The frontend mirrors the contract's pure function so it can explain the actual number before the Circle is deployed, while the on-chain calculation remains authoritative.
04 · State machine
Some outcomes are mathematically final before the clock expires
A naive vote waits until the end of its window even when later votes cannot alter the result. Bondline resolves in both directions as soon as the outcome becomes inevitable. Reaching the yes threshold refunds the stake immediately. Accumulating enough no votes that the remaining voters cannot reach the threshold forfeits it immediately.
Suppose three people can vote and two yes votes are required. The second yes makes approval final. Conversely, two no votes make approval impossible even if the remaining person votes yes. Waiting longer in either case adds latency without changing consensus.
approve early when: yesVotes >= required
reject early when: yesVotes + remainingVotes < required
otherwise: keep the vote open until another Cosign or expiry05 · Liveness
Silence forfeits; it never deadlocks the escrow
Three permissionless paths guarantee that a stake can always leave escrow. A decisive Cosign resolves immediately. resolveExpired settles a declaration whose voting window ended below the approval bar. crossMissed forfeits a Bond when the creator reaches the deadline without declaring completion at all.
This makes the absence of action an explicit protocol outcome. Neither the creator nor the Circle can keep funds stuck by refusing to send the final transaction; anyone may trigger a resolution once its condition is objectively true.
- Delivered and approved → stake refunds to the creator
- Approval becomes impossible → stake moves to the Pot immediately
- Vote expires below threshold → stake moves to the Pot
- Deadline passes without a declaration → stake moves to the Pot
06 · Incentives
Failure funds a shared outcome, not an anonymous penalty sink
Forfeited MON is credited to the Circle's Pot. Any member can propose a payout, and the Circle's threshold governs approval. That makes the loss socially legible: repeated misses fund something the group chooses together rather than disappearing into protocol fees.
Each Circle clone owns an isolated balance, and only BondlineCore can call its deposit and withdrawal paths. Tests assert that resolving a Bond in one Circle cannot change another Circle's Pot. Reentrancy guards and checks-effects-interactions protect the refund and payout paths, but the contracts remain an unaudited hackathon build running with real MON.
The economic sting also changes with group size. Because the creator remains a Circle member, they indirectly retain a share of the shared Pot. Small Circles preserve a stronger individual penalty; in large groups, social accountability becomes more important than the creator's net financial loss.
07 · Reflection
Mechanism design is mostly edge-case design
The main implementation lesson was that the happy path is the smallest part of the protocol. The difficult questions were whether the creator votes, when a result is mathematically inevitable, who can finalize silence, how Pot accounting stays isolated, and what happens when group membership changes.
Bondline v1 fixes Circle membership at creation and leaves payout proposals open without expiry. A production version would need governed membership changes, expiring proposals, clearer evidence standards, and an audit before larger stakes are reasonable.
The protocol works because it does not attempt to automate human judgment. It gives that judgment a precise threshold, a deadline, a liveness rule, and economic consequences the chain can enforce.