The subject stakes a claim
A protocol names an invariant — “the vault holds at least what was deposited” — and funds a bounty for breaking it and a premium for the underwriters who stand behind it.
Ethereum · soon
A contract is neither
safe nor broken, until
someone observes it.
Hilbert is a market that prices that uncertainty and settles it by proof. A protocol opens an observation on one of its own invariants. Underwriters stake coverage behind it; the stake is the only security rating that costs money to be wrong about. A hunter who can break the invariant proves it — on live state, in one transaction that reverts — and the coverage pays out.
hold → superpose → collapse
The market quotes doubt
Underwriters stake coverage against the invariant and earn the premium while it holds. How much coverage gathers per unit of bounty is the confidence rating — superposed, live, revised every block.
A proof collapses it
A hunter commits an exploit, then reveals it. The Prover runs it against real state inside a frame that is always discarded. If the invariant was false at the end of that path, the claim is real and the coverage pays.
Nothing here is an opinion.
No committee votes on a claim. No oracle is asked whether a hack happened. The exploit either executes and leaves the invariant false, or it does not. Hilbert reads the result of a path it then throws away, so the attempt drains nothing and can never be replayed by an observer — the state it touched never existed.
Settlementby proof, on-chain
Claim windowcommit → reveal
Hunter share of coverage10%
Owner / pause / upgradenone
Working capitalrefunded in full