The N are the parties who already have money on the mark.
A CrossDesk fixing is attested by a K-of-N committee. Its members are not hired referees; they are the issuer, the lender, the venue — parties who already hold an opinion on the number because they already carry a position against it. Attestation is a by-product of that position, and every signature is permanent and attributable on the ledger.
No committee has yet been convened. This page describes the model as specified in the methodology §7 and the signer protocol.
Sign the number you already rely on.
The hardest question anyone asks of a K-of-N design is: who are your N, what are they paid, and why would an institution accept exposure on someone else's fund? The answer is that nobody is asked to take on liability for a fee. Each signer is asked to sign the number it already relies on — the one its risk system consumes, the one its book carries — and to assert a fact only it can see. Nobody is doing anyone a favour. Every signer is worse off if the number is wrong.
Signers are not paid
Pay an attestor and they become a hired referee — the model that cannot be assembled or funded, and that raises indemnity questions nobody will sign. The signature is a by-product of a position.
Signers do not pay
They supply credibility. Charging them kills the supply. The committee is not a customer; the committee is how the product gets made.
Signers assert facts, not opinions
No seat is asked whether the price is right. Each seat confirms named conditions it alone can verify, or refuses by naming the one that failed.
| Recommended | Pilot minimum | |
|---|---|---|
| N (seats) | 5 | 3 |
| K (threshold) | 3 | 2 |
| Constraint | No single interest holds K | The three must be genuinely opposed: issuer · risk-taker · market-facing |
| CrossDesk as signer? | No | Tolerable at the very start, recorded as operator; exit as soon as a fourth party exists |
The administrator does not trade the instruments it prices. Signing is the adjacent conflict, and the operator seat, where it exists, is marked on every fixing it touches.
Chosen because they disagree.
Every committee is assembled from the same four seats. Fill as many as exist; three is a working quorum. The safety comes from the fact that their interests point in different directions.
| Seat | Who | What it knows that nobody else does | Bias |
|---|---|---|---|
| The issuer | Whoever created the token | Supply, reserves, redemption queue, corporate actions | Higher marks — par makes its asset look sound |
| The custodian / reserve holder | Whoever holds the underlying | What is actually there | Neutral, but liable |
| The taker of risk | The lender, collateral taker, clearer | What it will actually lend against it | Lower marks — it is under-collateralised if the mark is too high |
| The market-facing party | Market maker, authorised participant, venue | Where it would really trade right now | Depends on inventory — and the venue's range is checked by the ledger |
The issuer must never be a majority of the quorum. If the issuer can reach K using only parties it controls, the committee has proved nothing.
A committee of three issuers is not a committee. It is an expensive way for issuers to bless their own valuation. The named conditions each seat verifies — redemption integrity for the issuer, book acceptance for the lender, the observed traded range for the venue — are set out in the signer protocol. Only the venue's condition is checked by the ledger itself; the issuer's and lender's claims are recorded, attributable and permanent, but rest on the signer's own systems.
"You have seated people with positions and called it oversight. That is LIBOR."
It is the best argument against this design, and it deserves to be stated at full strength. LIBOR's panel banks submitted rates on instruments they held positions in, and some of them moved submissions to suit those positions. Three differences, structural rather than rhetorical:
The panel is composed to disagree
LIBOR's submitters shared a direction of interest. Here the issuer wants par, the lender wants conservative, the venue wants observed — and the methodology requires that no single interest holds K.
Submissions are verifiable rather than asserted
A LIBOR submission was an unfalsifiable estimate of where a bank could borrow. Every condition a CrossDesk signer confirms is a fact with a record behind it, and the venue's is checked by the ledger: an attestation whose range does not contain the price cannot exist.
Every signature is permanent and attributable
LIBOR ran on phone calls and unlogged discretion. Here who signed which fixing, under which protocol version, having verified which conditions, is on the ledger forever.
What honesty requires conceding. This is a mitigated conflict, not an absent one. A regulated administrator would seat independent members and manage conflicts by exclusion. This design manages conflict by opposition and evidence instead, because a panel of disinterested referees would never be assembled or funded for an asset this size. See Regulatory.
What happens when K is not reached in the window.
Each fixing is published with the tier that produced it. Tier 1 is the fixing; every other tier is a flagged fallback, and a value that is not painted gold on this site was not attested at tier 1 or 2. The strike window defaults to 30 minutes; a refusal inside it triggers a restrike.
| Tier | Value | Built today? |
|---|---|---|
| 1 | Attested. K of N seats confirmed the proposal, each naming the conditions it verified. Funds re-mark; the series row is published. | built, tested |
| 2 | Alternate seats. If a named seat is silent, a declared alternate for the same interest may attest in its place. | not built |
| 3 | Benchmark × last factor. For a wrapped asset, the current benchmark print multiplied by the last attested par factor, published as a fallback rather than an attestation. | arithmetic built; automatic fallback not built |
| 4 | Prior fixing, flagged. The previous fixing's recipe continues to derive a value, published as carried forward with the age of the underlying strike. Three consecutive carried-forward strikes trigger a cessation review. | built |
| 5 | Missed. No fixing exists for the session. The gap is published as a gap; no value is estimated to fill it. | built — a missed strike is reported, never filled |
What a fund does at tier 5 — suspend creations and redemptions for the session, or invoke a declared fair-value procedure — belongs to the fund's governing documents, not to the administrator, and must be specified before any fund relies on a CrossDesk fixing. The methodology §3 describes the same logic from the calculation side, with a sealed auction as the preferred source where a real market exists on Canton.
A wrong number is corrected in public, never overwritten.
Materiality
One basis point of the published value, or any error that changes a settlement obligation.
Same quorum
A correction needs the same K of N as a fixing. One signer cannot correct the record alone, and a restatement with no stated reason is refused on-ledger.
Original stays
The superseded fixing is not archived. It stays on the record, provably published, with the correction pointing back at it. Archiving it would let the members who published a wrong number veto its correction.
Window
Two business days from publication, as policy rather than code — enforcing calendar days on-ledger would silently shorten the window across a weekend. Every record carries its own timestamp, so a late correction is auditable.
Consumer rule: the current fixing for an identifier and session is the one no other fixing supersedes. Every party disclosed the original is disclosed the replacement.
Taking a seat.
A seat costs nothing and pays nothing. It requires a checker against your own systems that confirms when your conditions pass and halts when one does not. If you hold, lend against, issue or make markets in an asset CrossDesk fixes, that is the conversation.