Zero Settlement Risk Token Systems

If a token system permits programs with delayed exe- cution, or a transfer is programmed to occur conditional on reaching a future state, then agents can unilaterally transfer assets away from the accounts specified in the program in the gap that occurs between the time that a program is created, and the time at which a transfer instruction is recognized by the system. [...] When and if conditions are met, the bookkeeper applies the transformation φ ∈ Φ to the ledger `.10 The benefit from using a schedule is to delay the timing at which a bookkeeper gains access to private information on the ledger. [...] Trader A can use a schedule σ that delays the commitment of the program to date t, which postpones the timing at which the bookkeeper learns about the details of the instructions. [...] Intuitively, we can think of the bookkeeper having access to a machine that answers truthfully questions of the type “is the asset in account k at date (and state) t?” The bookkeeper does not know the entire state of the ledger and the information available is restricted to the information necessary to verify that a schedule is met. [...] At the time of settlement, the seller submits a program containing instructions to the book- keeper (in the form of a transformation) that specifies that the asset be moved from the seller’s account to the buyer’s account.