Disputes

Dispute a receipt

For reusable claims, send instruction 25 with [market, model, receipt_bucket(w), case(w), owner(s), payer(ws), system_program]. The payload is epoch:i64, index:u64, the 120-byte receipt, then 32-byte sibling hashes from leaf level upward. Its exact length is 136 + 32 × proof_height. The height is determined by the accumulator mountain containing that receipt index.

The receipt owner must sign before or at its dispute deadline. The epoch must match the bucket, the index must be below its recorded receipt count, and the reconstructed digest must equal the corresponding peak. Derive the case PDA from [b"receipt-case", bucket, epoch.to_le_bytes(), index.to_le_bytes()]. Initialization creates a 368-byte case with disputed status 2 and marker 0xa5 at 359; an existing case cannot be initialized again.

The charge and obligation move out of the bucket's aggregate into that case, while the offer's collateral exposure remains outstanding. For legacy claimed bookings, instruction 11 uses [market, model, booking(w), owner(s)], empty payload. The recorded owner signs within the stored dispute window to change status from 1 to 2.

let epoch = &p[..8];
let index = rd64(p, 8);
let receipt = &p[16..16 + RECEIPT_LEN];
require(
    hd[176..184] == *epoch && &receipt[..32] == owner.address().as_ref(),
    4,
)?;
require(Clock::get()?.unix_timestamp <= ri64(receipt, 112), 7)?;

Resolve a dispute

Send instruction 12 with [market, model, capacity(w), user(w), booking_or_case(w), admin(s), bond_vault(w), user_vault(w), mint, bond_authority, token_program], payload refund:u64. The market administrator must sign and the record must be disputed. Refund cannot exceed its recorded charge.

The refund transfers from the pinned provider bond vault to the user vault and increases free balance. Funded bond decreases by the refund; exposure decreases by the entire disputed charge; obligations decrease by one. Remaining funded bond must still cover the resulting exposure plus collateral headroom. The resolved record becomes finalized status 4.

The administrator selects the refund amount. The contract has no automatic adjudication rule, resolution timeout, or fallback resolver; an unresolved case retains its exposure and obligation.

require(
    admin.is_signer() && &md[8..40] == admin.address().as_ref(),
    4,
)?;