Pricing the Unprovable: Ambiguity, Turnstile Runs, and the Verifiability Discount in Crypto Protocols

Pricing the Unprovable: Ambiguity, Turnstile Runs, and the Verifiability Discount in Crypto Protocols

arXiv:2610.21540v1 [q-fin.TR] 15 Oct 2026

Doohwi Cha1[0009−0000−2513−6965]⋆ , Hanhee Kim2[0009−0008−1280−7043] , Hyeonjun Yeo3[0009−0005−9368−306X] , Minsuk Sung4[0009−0007−2282−6873] , Minjae Lee2[0000−0002−8937−9605] , Seunghan Son2[0009−0000−2902−9999] , Donghwa Seo5[0009−0003−5718−1535] , and Juyeong Lee6[0000−0002−4619−925X] Mirae Asset Securities, Seoul, South Korea doohwicha@gmail.com 2 Independent Researcher, Seoul, South Korea crypt0xb0@gmail.com, abraxasnz13@gmail.com, qzpm5n@g.skku.edu 3 Dept. of Physics and Astronomy, Seoul National University, Seoul, South Korea hj.yeo30@gmail.com 4 Department of Artificial Intelligence, Korea University, Seoul, South Korea minsuksung@korea.ac.kr 5 DS Investment & Securities, Seoul, South Korea properitas95@kaist.ac.kr 6 EY Consulting, Seoul, South Korea juyeong.lee0839@gmail.com 1

Abstract. Privacy-preserving protocols can repair a vulnerability without establishing whether it was exploited beforehand, even when no theft is reported and aggregate supply is protected. We call the potential value reduction from this gap the verifiability discount. A turnstile model shows how early withdrawal can shift a possible shortfall to remaining holders and why credible evidence can become more valuable as exposure grows. We introduce VDISC, a reproducible framework that records reported loss, exposed value, public evidence, returns, and pool flows separately. It combines Orchard’s staged disclosures with reconstructed on-chain flows, earlier Zcash cases, and a 40-event security panel. Orchard follows the predicted direction: market responses were muted after repair and supply assurance, while the largest negative return and aggregate shielded-pool net outflow aligned with the acknowledgment that past abuse could not be ruled out. These patterns are directional, not causal. Across events, market-cap-normalized reported loss and unresolved exposure overlap among the 38 events with a public loss figure (Pearson 0.86, Spearman 0.56), partly because exposure is often coded from the loss itself, so returns alone cannot distinguish reported loss from unresolved history. The findings motivate three candidate design priorities: produce privacy-compatible evidence about past states, limit the state exposed by a single flaw, and disclose residual uncertainty explicitly. ⋆

Corresponding author.

2

D. Cha et al. Keywords: Blockchain economics · Cryptoeconomics · Ambiguity · Event study · Shielded pools · Verifiability · Security disclosure.

1

Introduction

When a security flaw is disclosed, investors ask how much was lost and whether the flaw was fixed. Privacy-preserving protocols add a third question: can outsiders verify what happened before the fix? A patch may stop new abuse and a supply rule may protect total supply, yet private transaction history can leave past abuse impossible to rule out. Finding no abuse is therefore weaker than proving that abuse could not have occurred. The June 2026 Zcash Orchard sequence separated these questions in time. The repair announcement reported no evidence of exploitation or unauthorized value creation and no detected impact on total supply [41]; hours later the Zcash Foundation confirmed both, citing the turnstile, which limits transfers out of each shielded pool to its recorded balance [39]. The disclosing team later judged prior exploitation unlikely but stated that public evidence could not rule it out [36]. ZEC was already falling before that statement, so timing alone is not causal; the sequence instead permits a staged comparison of early assurance—notice, repair, and supply protection—with later unresolved history. We call the value reduction associated with adverse histories that remain possible after repair the verifiability discount. Investors need not agree on a precise hidden-loss probability: leaving several adverse histories open can itself affect valuation and exit. This is ambiguity in the sense of decision-making under uncertain probabilities [21, 23, 27]. The paper makes five contributions. First, it defines a pricing construct that separates reported loss from adverse histories that public evidence cannot close. Second, it develops a formal turnstile model. Early withdrawal can shift more of a possible shortfall to remaining holders; locally, exit pressure rises with unresolved exposure (Proposition 1), and proof can be more valuable when more value was exposed (Proposition 2). Third, it builds a four-anchor Orchard evidence design that pairs returns with net unshielding—ZEC leaving the aggregate shielded pools minus ZEC entering them. Fourth, earlier Zcash cases, 14 coded disclosures, and a 40-event panel make the identification boundary explicit: Orchard and the earlier Zcash cases show timing and direction rather than a causal effect, the cross-event pilot does not identify even the sign of the CAR–z slope, and reported loss and unresolved history require separate measures. Fifth, VDISC records source and time, reported loss, exposure, public proof, returns, and pool flows separately and maps them to three design priorities: strengthen past-state evidence, limit single-flaw exposure, and state what remains unresolved. Figure 1 summarizes the mechanism.

Pricing the Unprovable: The Verifiability Discount

REPAIR

3

reported loss + severity a + bL obs + cs

future flaw closed

tr EXPOSED PAST

PUBLIC EVIDENCE

RESIDUAL EXPOSURE

θ

q

z = θ(1 − q)

ρz

DISCOUNT D = −CAR

m * (z) ↦ κm * (z)

TURNSTILE EXIT

net-unshielding proxy

Fig. 1. Evidence pipeline for the verifiability discount. Repair at tr closes future abuse but does not resolve the past. Public evidence q maps exposure θ to residual z = θ(1−q). On a locally stable branch, z enters D = −CAR directly through ρz and indirectly through turnstile exit m∗ (z) and price pressure κm∗ (z); reported loss Lobs and severity s enter separately. Arrows encode model channels, not causal estimates; net unshielding indicates exit direction but does not measure gross exit.

2

Related Literature

Ambiguity arises when investors do not know which probability or model applies [21,23,27]; markets price it separately from volatility [9], including in crypto returns [28]. Security-disclosure and crypto event studies show that news about loss, exposure, and controls moves prices, including after 51% and broader attacks [11–13,31–34]. Orchard adds a distinct object: a patched flaw and protected supply whose private past still cannot be verified. The verifiability discount therefore records reported loss separately from adverse histories that remain open. Run models show why sequential withdrawals can induce exit before uncertainty is resolved [19, 24, 30]; related incentives appear in stablecoins [1, 17], and concentrated selling depresses prices in shallow markets [10]. Here early exit can shift more of a hidden shortfall to remaining holders, linking incomplete proof to flow and price. Zerocash introduced anonymous zero-knowledge payments [2], whose soundness depends on correct circuit computation [22]. In Zcash, transfers inside a shielded pool are hidden while entries and exits remain visible [26]. A later circuit repair may thus leave earlier private use unresolved. Our model lets proof close possible histories and the turnstile allocate any remaining shortfall.

4

3

D. Cha et al.

From Unverifiable History to Valuation and Exit

The model asks what changes when future abuse is stopped but pre-repair abuse cannot be ruled out. If some claims may be invalid, early exit avoids part of that risk and spreads the same possible shortfall over fewer remaining claims. Public proof narrows those possible histories. The model links the unresolved remainder to a price discount and exit pressure. For event i, exposure θi is the share of the relevant claim base that was vulnerable to the disclosed flaw. Public proof strength is qi ∈ [0, 1]. At qi = 1, public evidence rules out the relevant adverse histories; at qi = 0, it rules out none of them. Residual unverifiable exposure is therefore zi = θi (1−qi ). Reported loss Lobs is the amount quantified by public sources, whereas actual loss in i private state, L∗i , may be different or impossible to observe. The severity signal si records other observable event characteristics and deliberately excludes residual unverifiability. Because L∗i is unobserved, it does not enter the empirical equation directly: Di = −CARi = a + bLobs + csi + γ θi (1 − qi ) + ηi . (1) i Here a larger Di = −CARi means a larger negative abnormal return. The equation records reported loss, observable severity, and residual unverifiable exposure separately; γ is the association with the last component after the first two are included. A single return still cannot identify all three channels, so the empirical analysis also examines on-chain exit behavior. 3.1

A Two-Date Turnstile Run

Choices and information. At date 0, a vulnerability is disclosed and patched; at date 1, a migration or supply proof either resolves the pool history or leaves it open. Normalize holders, claims, and the value of each valid claim to one. Invalid claims x are unobserved, with x ∈ [0, θ(1 − q)]. Exposure θ widens this range, proof q narrows it, and z ≡ θ(1 − q) is the maximum unresolved claim value. Under maxmin preferences [23], investors evaluate the worst publicly admissible case, x = z, rather than assigning probabilities to each x. Each holder exits or stays. With exit mass m, a slack turnstile processes unshielding at par, while selling realizes 1 − κm, where κ ∈ (0, 1) measures price pressure. Exit also costs holder j an idiosyncratic φj (tax, lost privacy, inattention, or other friction), distributed by F on [0, φ̄]. We assume F is continuously differentiable and strictly increasing, with f = F ′ > 0 near an interior cutoff, F (0) = 0, and φ̄ > 1 − κ. Why exit can reinforce itself. The turnstile limits unshielding to the recorded pool balance and serves requests in block order, a sequential service constraint [19]. Invalid claims add demand without capacity, so total demand can be m + x against unit capacity. Even while the turnstile is slack (m + x ≤ 1), after masses m and x leave, the remaining 1 − m claims have only 1 − m − x backing. At the worst case x = z, a stayer receives max{0, 1 − z/(1 − m)}. More exit

Pricing the Unprovable: The Verifiability Discount

5

therefore concentrates the possible shortfall on fewer stayers and can induce further exit. This matches Zcash’s emphasis on pool totals and remaining supply [20]: unresolved history creates the incentive, and the turnstile allocates the possible shortfall. Equilibrium. With a slack turnstile (m ≤ 1 − z), exit avoids worst-case dilution but incurs individual cost and market impact. Holder j exits when φj < g(m; z), where z − κm. (2) g(m; z) = 1−m The first term is the dilution avoided by leaving; the second is the price cost of joining a larger exit. The best-response mass is B(m; z) = F (max{0, g(m; z)}), and equilibrium requires B(m; z) = m. Because m raises both avoided dilution and market impact, B need not be monotone. We focus on runs before capacity is exhausted, isolating shortfall concentration from a specific rationing rule. For some ẑ ∈ (0, 1), impose z ≤ ẑ and F (1 − κ(1 − ẑ)) ≤ 1 − ẑ; such a ẑ exists because F (1 − κ) < 1. Then m > 1 − ẑ cannot be an equilibrium, since even the most favorable rationing rule gives B(m; z) ≤ F (1 − κ(1 − ẑ)) ≤ 1 − ẑ < m. Continuity supplies a fixed point in the slack region. Because concentration and market impact move incentives in opposite directions, we claim neither global monotonicity nor uniqueness. Comparative statics apply only to differentiable, locally stable branches with |Bm (m∗ ; z)| < 1, where small deviations are not amplified. On a locally stable branch, unresolved history affects the date-0 discount in two ways. Investors apply a direct haircut to the possible shortfall, and the resulting exits add market-price pressure: D = a + bLobs + cs + ρz + κ m∗ (z).

(3)

Here ρz is the direct valuation effect and κm∗ (z) is exit-driven price pressure. Thus the reduced-form γ in Eq. (1) combines both responses locally. Returns contain both; on-chain flow provides a separate directional check on exit. The next two propositions formalize the model’s central claims. The first establishes when unresolved history produces exit pressure. The second shows why proof is more valuable when a larger claim base was exposed. Proposition 1 (run intensity). Under the slack-turnstile condition, for z = θ(1 − q) ∈ [0, ẑ]: (i) if z = 0 (i.e. q = 1 or θ = 0), the unique equilibrium is m∗ = 0; (ii) if z > 0, every equilibrium has m∗ > 0 and leaves the turnstile slack (m∗ +z ≤ 1) under any rationing rule; (iii) along any differentiable locally stable threshold branch with an interior cutoff, dm∗ /dz > 0. The empirical design uses only the corner at q = 1 and this local directional implication; it does not rely on global uniqueness or global monotonicity. Proposition 2 (proof–exposure complementarity). The direct ambiguity component of (3) has ∂ 2 [ρθ(1 − q)]/∂θ ∂q = −ρ < 0: the price value of proof

6

D. Cha et al.

strength scales with exposed value. The run component reinforces this complementarity on differentiable stable branches whenever d[z m∗′ (z)]/dz ≥ 0; this curvature condition holds in the uniform-cost benchmark but is not imposed globally. Proof Sketch. If z = 0, then g(m; 0) ≤ 0, so B(·; 0) = 0 and m∗ = 0 is unique. If z > 0, then B(0; z) = F (z) > 0, so zero cannot be an equilibrium; the slack condition excludes capacity-binding equilibria. On a differentiable stable branch, Bz (m∗ ; z) dm∗ = > 0. dz 1 − Bm (m∗ ; z) because Bz = f (g)/(1 − m) > 0 at an interior cutoff and local stability gives 1− Bm > 0. Hence m∗ rises locally with z. The negative cross-partial in Proposition 2 says that proof reduces the direct discount more when exposure is larger; the run component shares this complementarity only under the stated curvature condition. Uniform-Cost Benchmark. For illustration, let F (φ) = φ/φ̄ and A = φ̄ + κ, combining exit-cost dispersion and market impact. If 0 < z < A/4, κ < φ̄, and m∗− (z) + z < 1, the locally stable branch is m∗− (z) =

1−

p

1 − 4z/A , 2

∂m∗− 1 = p > 0. ∂z A 1 − 4z/A

The lower root is the stable slack solution. Its positive, increasing derivative shows a locally steeper exit response as unresolved exposure grows. Magnitudes depend on A, so this is intuition, not calibration. Model Implications and Scope. Complete proof or zero exposure sets z = 0 and removes ambiguity-driven exit; on a locally stable interior branch, more z raises exit. Stronger proof also reduces the direct discount more when exposure is larger, with run reinforcement only under Proposition 2’s curvature condition. These are local signs under maxmin evaluation, a slack turnstile, linear market impact, and local stability, not claims of a run after every disclosure or of a unique global equilibrium. The case study tests these directions rather than structural parameters. Its net pool flow (outflow minus inflow) is only a directional proxy for the model’s gross exit mass m; prices, pool flow, and order flow are complementary rather than interchangeable evidence. Two distinctions matter when taking the model to data. First, z = 0 is a sharp boundary, whereas the positive-z result is local and does not imply that every incident produces a run. Second, observed net flow subtracts inflows from gross outflows, while m counts gross exit. Agreement in direction is informative, but their magnitudes are not interchangeable. Transaction-level records, protocol timestamps, or cryptographic commitments would map withdrawals to the model more tightly and support nonlinear or adaptive extensions.

Pricing the Unprovable: The Verifiability Discount

3.2

7

Predictions and Their Empirical Tests

The price equation gives P1: with weak proof, larger exposure θi is associated with a larger discount; and P2: holding exposure fixed, credible supply, containment, or migration evidence raises qi and reduces the discount. These are directional, not causal, associations. The turnstile gives P4: ambiguity-driven exit is zero at z = θ(1 − q) = 0 and rises locally with positive z on a stable interior branch. Net unshielding after unresolved-history news provides a directional check, not an estimate of gross exit mass m. P5 says the direct value of proof rises with exposure; run reinforcement requires the stated curvature. P3, an untested extension in which AI-assisted discovery changes perceived vulnerability arrival, lies outside the two-date model. Accordingly, four ZEC anchors examine P2, on-chain flow checks P4, and the cross-event panel examines P1. P5 informs design but is not estimated. Returns and flows test predicted directions, not a causal ambiguity effect.

4

Measuring Loss, Unverifiability, and Holder Response with VDISC

Testing requires separate measures of damage, unresolved history, and holder response. The coverage layer links 151 of 544 DeFiLlama seed incidents to token prices, defining availability rather than an event-study sample [18]. The analysis layer contains four official Bitcoin or Zcash cases and ten disclosures coded by fixed rules; a separate 40-event panel examines loss–unverifiability overlap. Included events require a timestamped disclosure or remediation, a traded token, price history, and sufficient public records. VDISC records exposure θ and proof q separately: a severe event need not be hard to verify. Exposure is the potentially affected claim base, proxied within failure class by shielded-pool balance, bridge or affected total value locked (TVL), or excess minted value, each scaled by supply or market value; ratios above one are capped and flagged. When a record quantifies only the stolen amount, that amount serves as the affected value. Proof asks how much public evidence closes adverse histories. Bounds on abuse, stolen funds, affected addresses, or contaminated state strengthen q; material unresolved abuse weakens it. Empirical q averages five yes/no checks within two days: supply proof, containment, replayability, migration proof, and an official residual-uncertainty statement. Each requires a public URL and quote; later evidence is stored separately. Because this window overlaps part of the daily cumulative abnormal return (CAR), q organizes evidence rather than acting as a predetermined treatment. It also proxies auditability, not structural q: stating an unknown makes it visible without necessarily reducing it. Automated models retrieve candidate sources and propose labels, but those labels do not construct θ or q and do not enter the empirical tests. In a frozen 50-event audit of GPT-5.4 Mini and Qwen3.7 Plus, 99 of 100 outputs cited a

8

D. Cha et al.

source with an evidence summary; inter-model Cohen’s kappa was 0.65 for type and 0.58 for severity but only 0.002–0.052 for judgment-dependent fields. Thus fixed formulas and checklists construct θ and q; model-assisted judgment remains future work. For reproducibility and safety, collection uses public timestamped sources and excludes exploit instructions, payloads, keys, discovery prompts, live-system procedures, and other unsafe fields. Fixed fields and observation times preserve Orchard’s disclosure sequence instead of collapsing it to one date.

5

Orchard: Four Anchors and One Unresolved Past

Repair and supply assurance arrived together; proof of past non-abuse did not arrive in the sample window: the later statement said Orchard data could not provide it cryptographically and proposed an upgrade to prove supply integrity. We use four timestamped public statements as anchors: the first notice, the NU6.2 repair with its remediation statement, the Foundation’s confirmation, and the later statement that prior exploitation could not be ruled out. After May 29 discovery, a soft fork disabled Orchard at block 3,363,426, timestamped 03:30 UTC on June 2 [7] (official posts give 02:00–02:30; we use the block time), before the 06:20 notice [40]; it is an operational reference, not an anchor. NU6.2 restored operation on June 3 at 04:05, and the 04:09 remediation statement reported no evidence of exploitation or unauthorized value creation and no detected impact on total supply [41]. At 10:55 the Foundation confirmed both points [39]. On June 4 at 21:33:53, the context post judged prior exploitation unlikely but said Orchard data could not rule it out cryptographically, and proposed a supply proof [36]. Hayes later announced an exit, but its execution time is unknown [25]. 5.1

Market Ordering and Event-Study Design

The market test asks whether ZEC responds to each anchor’s information. A standard event study [29] subtracts its usual BTC-linked return. For token i and period Pτ2 t, Ri,t = αi +βi Rm,t +εi,t , ARi,t = Ri,t − α̂i − β̂i Rm,t , and CARi (τ1 , τ2 ) = t=τ1 ARi,t . Thus CAR accumulates ZEC return unexplained by hourly Binance BTC/USDT [4]. The model uses 335 pre-discovery hours ending May 28 at 23:00 UTC; matched pre/post windows contain 24 complete returns and omit the anchor bar. Table 1 shows the ordering: CAR is 0.185 after notice, 0.014 and 0.016 after the repair statement and its confirmation, and −0.162 only after past exploitation cannot be ruled out. This matches the predicted direction but is not causal identification. The context tail probability is pob = 0.003 and qBH = 0.051 across the 16-test family [3]; its pre-anchor CAR is already −0.134, which reaches the same placebo floor. Corrado ranks [16], a GARCH volatility diagnostic motivated by eventinduced-variance concerns [8], log returns, and 60/90-day windows (p ≤ 0.001)

Pricing the Unprovable: The Verifiability Discount

9

Table 1. ZEC cumulative abnormal returns before and after the four Orchard anchors. Anchor

UTC

What became public

Public notice NU6.2

6/2 06:20 Initial containment notice

24 h preCAR

24 h Context-post post- tail test CAR

0.052

0.185

0.185 0.014 6/3 04:05 Corrected circuit; no evidence of exploitation; supply unaffected 0.148 0.016 Foundation 6/3 10:55 Confirms no known post exploitation and intact supply Context 6/4 21:33 Prior exploitation judged -0.134 -0.162 pob = 0.003; post unlikely but not ruled out qBH = 0.051 Note. CAR is the cumulative BTC-adjusted return. Each pre- and post-window contains 24 complete hourly returns. For the context post, pob is the one-sided lower-tail placebo probability, the smallest value attainable with 312 overlapping pre-discovery blocks, and qBH is the Benjamini–Hochberg adjusted value within the 16-test family (4 anchors × 4 statistics).

preserve the negative sign; no leakage appears from May 30 00:00 to June 2 07:00. These checks do not create a causal break: the final post bundled severity with unverifiability and repricing had begun earlier. The context window is therefore unusual, but it clears a conventional 5% threshold only before adjustment for multiple testing. Its negative pre-CAR is also economically important: robustness to clocks and estimators cannot turn a price decline already under way into a disclosure-time discontinuity. 5.2

Minute Anchor Check and Cross-Venue Robustness

The same statement first appeared as an X article at 21:17 UTC, 16 minutes before the forum post [37]. Reanchoring to that time changes minute CAR from −0.166 to −0.205 but not its sign. Same-window CARs on Coinbase, Kraken, OKX, and Bybit range from −0.155 to −0.166 [14]; Bybit is a perpetual, so these are not four independent spot replications. Figure 2 shows why this robustness is not a sharp break. CAR had already fallen by 0.208 since midnight (0.188 by 21:17). Turnover was comparable to the June 3 crisis day until about the time of the X release and about four times higher in the 16 minutes before the forum post; the post-anchor 60-minute decline was about 1.6 times the pre-anchor decline. Hayes confirms an exit announcement, not execution time [25]. The sign survives timestamp choices, but the earlier movement precludes a discrete causal interpretation.

10

D. Cha et al. A Hourly price S N/F

B Minute price M→C 16 min

C

F

600

ZEC/USDT

ZEC/USDT

D

500 400

E

600

400

0.4

C Hourly cumulative AR

D Minute cumulative AR Cumulative AR

Cumulative AR

300

0.2 0.0 −0.2 28 May

31 May

D Discovery M Mention

03 Jun

06 Jun

S Soft fork C Context

0.00 −0.25 −0.50 −0.75 03 Jun

04 Jun

N NU6.2 E Exit announcement

05 Jun F Foundation 60-min trough

Fig. 2. Orchard market evidence. Panels A/C show hourly price and BTC-adjusted CAR; B/D show minute data through June 5 12:00 UTC. Shading marks the zoomed interval and largest 60-minute decline. N/F shares a top-rail tag because its two true lines are only 6 h 50 min apart; M→C marks the true 16-minute gap between the 21:17 X article and the forum post. Negative movement predates the final anchor, so markers establish timing rather than causal breaks.

5.3

On-Chain Exit Evidence

P4 is checked with net unshielding: ZEC leaving the aggregate Sprout, Sapling, and Orchard shielded pools minus entering them. This measures net aggregate shrinkage rather than gross exits. Per-block changes reconstruct June 1– 7 daily/hourly flow [7]; levels agree within 0.1% with zcashinfo/node snapshots [38, 42]. Pool-specific snapshots show that Orchard accounted for 97.4% of the May 24–June 7 aggregate shielded decline. In Figure 3, flow is small or constrained around pause/repair, but reaches 175,568 ZEC in the 24 hours after the context post, about 49× baseline (Table 2). From the first complete 22:00 UTC bin, 48 hours total 243.2k ZEC, or 4.8% of the aggregate shielded balance. A single block (June 5, 19:34 UTC; 20 transactions) nets 60,324 ZEC of outflow, 34% of the 24-hour total; without it, the 24-hour outflow is still about 32× baseline. Thus the largest net outflow aligns with the widest publicly recognized unresolved history.

Pricing the Unprovable: The Verifiability Discount

11

Table 2. Net movement out of the aggregate Sprout, Sapling, and Orchard shielded pools during the first 24 complete hours after the soft fork and each disclosure anchor. Anchor (pool state)

Net unshielding (ZEC) How to read the comparison

A Daily net flow and pool level 150

zcashd

zcashinfo

5.1

100

5.0

50 4.9 0

zcashinfo

Net outflow (kZEC/h)

16 May

21 May

26 May

31 May

05 Jun

Pool level (M ZEC)

Net outflow (kZEC)

Soft-fork pause (Orchard off) -7 Constrained; not comparable NU6.2 (restored) 7,573 Pent-up flow possible Foundation post (operating) 9,052 Overlaps NU6.2 Context post (operating) 175,568 About 49× baseline Note. A positive value means that more ZEC left the aggregate shielded pools than entered them; it is not the total amount withdrawn. The pause window starts at 04:00, the first complete hour after the 03:30 activation (a 02:00 start gives −125). The NU6.2 and Foundation 24-hour windows overlap by 18 h. The May 15–28 baseline is 3,560 ZEC per day.

10 Jun

B Hourly net flow 50

S

N

C F

0 01 Jun

02 Jun

03 Jun

S Soft fork

04 Jun N NU6.2

05 Jun

06 Jun

F Foundation

07 Jun

08 Jun

C Context

Fig. 3. Aggregate shielded-pool balance and net unshielding around the Orchard disclosures. Panel A compares daily flow, reconstructed aggregate balance, and independent snapshots; Panel B shows June 1–7 hourly flow. The dotted band marks discovery; navy and hatched bars denote net outflow and inflow. Snapshot agreement supports the reconstruction, but net movement is not total holder exit.

12

D. Cha et al.

Among the paper’s noncausal measures, this independently reconstructed flow is the mechanism-nearest within-event directional test of P4, not an estimate of structural m. Pause spending was disabled, the NU6.2/Foundation windows overlap by 18 hours, and net flow can include delayed transfers or offsetting inflows. Prices, sales, and flows are jointly determined, so the series does not identify a causal ambiguity effect. 5.4

Cross-Market Diagnostics

Cross-market data ask whether the move is venue-specific or market-wide. Under the 21:00 UTC hour-floor convention, Binance contract open interest rises 21.8% while its dollar value falls with price and spot market-order flow remains net selling [4, 5]. Relative to their pre-windows, XMR/ETH weaken more, DASH improves, and SOL is nearly flat [15]. Thus the decline extends beyond one venue but is not uniform across peers. Jointly determined prices, positions, and flows do not identify its cause; Orchard’s value is the staged comparison of public evidence, price, and reconstructed flow.

6

Cross-Event Evidence and the Identification Problem

6.1

Applying VDISC Beyond Orchard

We apply Section 4’s rules to 14 disclosures with public records: four official Bitcoin or Zcash cases [6, 20, 35, 36] and ten bridge, contract, governance, oracle, or privacy proof failures. This purposive sample tests measurement, not a population effect. Daily CARs use an ETH/USDT market model estimated on days −120 to −21. Calendar-day timing can include pre-disclosure movement: Orchard’s 21:33 UTC post would otherwise be credited with the whole June 4 return. Table 3 therefore re-estimates the CAR–z slope for the nine priced events on the first three complete post-disclosure days. Re-timing Orchard alone moves the slope from −0.172 to −0.097; applying the same rule to all nine gives +0.027. The calendar-day interval excludes zero because that clock credits Orchard’s June 4 decline, which began before the post, to the disclosure; both re-timed pairsbootstrap 95% intervals span zero, so the pilot does not identify even the sign of the slope. Leverage, proxies, and record completeness also differ. 6.2

Comparison with Earlier Zcash Events

Within Zcash, the aggregate shielded pool grows in the complete-proof case (Sprout itself accepts no deposits [35]), while two unresolved cases show outflow relative to baseline (Table 3), consistent with P4. Daily gross, daily net, and anchored net units differ, so response magnitudes cannot be ranked.

Pricing the Unprovable: The Verifiability Discount

6.3

13

Why Returns Cannot Separate the Two Channels

Among 38 events with a public loss figure (four official cases report zero), marketcap-normalized reported loss and unresolved exposure co-move (Pearson 0.86, or 0.75 without Multichain; Spearman 0.56), so a negative return cannot distinguish them. With all 38 events on the first three complete post-disclosure days, residuals from a regression of the discount on loss/mcap do not differ between the nine custody- or privacy-unverifiable events and the rest (Welch p = 0.46), and Orchard ranks 18/38. The panel documents confounding; Orchard anchors and pool flows add timing/behavior evidence, not a separate causal estimate. The 0.86 correlation is not an estimated verifiability effect, and part of it is built into the records: in 17 of the 31 worksheet-coded events, the exposure numerator equals the reported loss. A return regression then loads on both channels unless external evidence measures proof and exposure separately; a separate exposure field helps only when exposure is sourced independently of the loss. Table 3. Cross-event directional comparisons and identification diagnostics. Panel A. Same-chain directional comparison Event

z

Measure

Baseline → event

Sprout 2026

0.000 Daily 435 out/day → 14,026 inflow aggregate net Sprout 2019 0.020 Daily gross 8.8k/day → 25.4k out Orchard 2026 0.162 24h 3,560 out/day → 175,568 out aggregate net

Within-event response Aggregate pool grows ≈ 2.9× ≈ 49×

Panel B. Cross-event scope and frontier Exercise (coverage)

Result

Clock sensitivity (14 Orchard CAR −0.334 → +0.015 on the first 3 events; 9 priced) complete post-days; CAR–z slope −0.172 (calendar days), −0.097 (Orchard re-timed), +0.027 (all nine re-timed) Loss frontier (40 corr(loss/mcap, z) = 0.86 (Spearman 0.56); events; 38 with a loss residual-group Welch p = 0.46 figure) Orchard residual −0.57σ; rank 18/38 (rank among 38)

Reading Sign not identified Loss–z co-move, partly by construction No outlier

Note. Pairs-bootstrap 95% intervals for the three slopes are [−2.237, −0.004], [−2.103, 0.282], and [−0.402, 0.306]. Frontier residuals use the first 3 complete post-days for all 38 events; re-timing Orchard alone gives Welch p = 0.31 and −0.61σ (rank 19/38).

The comparison shows why exposed state and public proof must be observable before loss, exposure, and unresolved history collapse into one return.

14

7

D. Cha et al.

Protocol Design Implications

Design asks whether outsiders can verify history (q), how much state one fault can expose (θ), and whether withdrawals reveal exit pressure (m). Table 4 maps each question to public evidence. Table 4. Verifiability-by-design evidence map. Mechanism

Uncertainty addressed

Proof and accounting mechanisms State replay Historical non-abuse Balance proof Aggregate supply Containment Maximum affected set

Public evidence produced Replayable logs, checkpoints, or snapshots Aggregate-balance proof Quarantine evidence or bounded loss sets

Operational and disclosure controls Turnstile gate Cross-pool boundary Boundary, conversion log, or invariant Migration path Future state; legacy-state Migration/retirement proof; new keys treatment Residual notice Unknowns explicit—not Proved/unproved/unknown split reduced

Replay, balance, and containment evidence strengthen q or bound θ; boundary, migration, and disclosure records clarify operations and m. These are complementary design candidates, not tested or causally ranked controls. The distinction is operational. Replay and balance proofs tell outsiders what can be ruled out about the past; containment and migration limit which state a fault can affect. A residual-uncertainty notice does not close the unknown set, but it prevents proved, unproved, and unknown claims from being conflated.

8

Limitations

The evidence ladder answers distinct questions: Orchard anchors order public knowledge and returns; reconstructed flow checks holder movement; earlier Zcash events test within-protocol direction; and the 40-event panel asks whether returns separate loss from unresolved history. They do not in this sample. The pattern fits the turnstile mechanism but is not a causal discount estimate: the final statement bundled severity with unverifiability, price fell earlier, event clocks and proxies differ, the 14 cases are purposive, and net flow is not gross exit. Primary sources, fixed coding, and a frozen model-assisted-coding audit make decisions reproducible without removing these limits. This defensive study uses only public, patched-event evidence; it develops no exploit code, targets no live system, and excludes unsafe raw outputs.

Pricing the Unprovable: The Verifiability Discount

9

15

Conclusion

Privacy changes what repair can establish. A patch closes the disclosed flaw; it does not prove whether private state was abused beforehand. We call the market consequence of that gap the verifiability discount. It can matter even with no reported theft and protected aggregate supply because public evidence may still leave past abuse unresolved. The turnstile model explains the incentive: an early exit can avoid part of a possible shortfall and leave more to remaining holders. Orchard’s staged anchors match the predicted direction—a positive return after notice, near zero after repair and supply assurance, and the largest negative post-anchor return (−0.162) after past abuse could not be ruled out. Net unshielding over the next 48 complete hours was 4.8% of the aggregate shielded balance. These patterns, and earlier Zcash comparisons, are directional evidence rather than causal estimates. In 40 security events, market-cap-normalized reported loss and unresolved exposure were correlated among the 38 with a public loss figure (Pearson 0.86, Spearman 0.56), partly because exposure is often coded from the loss itself. A return therefore cannot show whether markets priced reported loss, unresolved history, or both. Methodologically, VDISC records source and time, loss, exposure, public proof, return, and pool movement as separate fields. It then compares their timing across Orchard, earlier Zcash cases, and the broader panel, making explicit what outsiders can and cannot establish without treating an event return as causal. Repair should provide evidence as well as corrected code. Protocols should limit the state one flaw can expose, prepare evidence that preserves privacy while bounding past abuse, and state what remains unknown. Resilience requires both stopping future abuse and making pre-repair history as auditable as privacy permits. Declarations. No human-subject data are used; all inputs are public, timestamped sources. The authors have no competing interests to declare. The views are those of the authors, not their affiliated institutions, and this academic paper is not investment advice. An AI agent assisted with language editing, table generation, and consistency checks; the authors reviewed all output and take full responsibility for the manuscript.

References 1. Ahmed, R., Aldasoro, I., Duley, C.: Public information and stablecoin runs. BIS Working Papers 1164, Bank for International Settlements (2024), revised January 2025 2. Ben-Sasson, E., Chiesa, A., Garman, C., Green, M., Miers, I., Tromer, E., Virza, M.: Zerocash: Decentralized anonymous payments from Bitcoin. In: 2014 IEEE Symposium on Security and Privacy. pp. 459–474 (2014) 3. Benjamini, Y., Hochberg, Y.: Controlling the false discovery rate: A practical and powerful approach to multiple testing. Journal of the Royal Statistical Society: Series B 57(1), 289–300 (1995)

16

D. Cha et al.

4. Binance: Spot Kline/Candlestick Data API. https://developers.binance.com /docs (2026), official documentation for /api/v3/klines 5. Binance: USD-M Futures Open Interest History API. https://developers.binan ce.com/docs (2026), official documentation for /futures/data/openInterestHist 6. Bitcoin Core: Disclosure of CVE-2018-17144. https://bitcoincore.org/en/201 8/09/20/notice/ (2018), accessed 2026-06-06 7. Blockchair: Blockchair Zcash block database API. https://api.blockchair.com /zcash/blocks (2026), accessed 2026-06-10 8. Boehmer, E., Musumeci, J., Poulsen, A.B.: Event-study methodology under conditions of event-induced variance. Journal of Financial Economics 30(2), 253–272 (1991) 9. Brenner, M., Izhakian, Y.: Asset pricing and ambiguity: Empirical evidence. Journal of Financial Economics 130(3), 503–531 (2018) 10. Brunnermeier, M.K., Pedersen, L.H.: Market liquidity and funding liquidity. The Review of Financial Studies 22(6), 2201–2238 (2009) 11. Campbell, K., Gordon, L.A., Loeb, M.P., Zhou, L.: The economic cost of publicly announced information security breaches: Empirical evidence from the stock market. Journal of Computer Security 11(3), 431–448 (2003) 12. Cavusoglu, H., Mishra, B., Raghunathan, S.: The effect of Internet security breach announcements on market value: Capital market reactions for breached firms and Internet security developers. International Journal of Electronic Commerce 9(1), 70–104 (2004) 13. Cheraghali, H., Molnár, P., Storsveen, M., Veliqi, F.: The impact of cryptocurrencyrelated cyberattacks on return, volatility, and trading volume of cryptocurrencies and traditional financial assets. International Review of Financial Analysis 95, 103439 (2024) 14. Coinbase, Kraken, OKX, Bybit: Official Public Candle Endpoints. https://docs .cdp.coinbase.com; https://docs.kraken.com; https://www.okx.com/docs-v5; https://bybit-exchange.github.io/docs/v5/market/kline (2026), official candle API documentation 15. CoinGecko: Coin historical chart data within time range by ID. https://docs .coingecko.com/reference/coins-id-market-chart-range (2026), endpoint template; scripts substitute concrete CoinGecko IDs; accessed 2026-06-16 16. Corrado, C.J.: A nonparametric test for abnormal security-price performance in event studies. Journal of Financial Economics 23(2), 385–395 (1989) 17. d’Avernas, A., Maurin, V., Vandeweyer, Q.: Can stablecoins be stable? Management Science (2026). https://doi.org/10.1287/mnsc.2024.06992, published online May 26, 2026 18. DeFiLlama: Hacks Dataset API. https://api.llama.fi/hacks (2026), frozen research snapshot accessed 2026-06-12 19. Diamond, D.W., Dybvig, P.H.: Bank runs, deposit insurance, and liquidity. Journal of Political Economy 91(3), 401–419 (1983) 20. Electric Coin Company: Zcash counterfeiting vulnerability successfully remediated. https://electriccoin.co/blog/zcash-counterfeiting-vulnerability-succe ssfully-remediated/ (2019), accessed 2026-06-06 21. Epstein, L.G., Schneider, M.: Ambiguity, information quality, and asset pricing. Journal of Finance 63(1), 197–228 (2008) 22. Gennaro, R., Gentry, C., Parno, B., Raykova, M.: Quadratic span programs and succinct NIZKs without PCPs. In: Advances in Cryptology – EUROCRYPT 2013. pp. 626–645 (2013)

Pricing the Unprovable: The Verifiability Discount

17

23. Gilboa, I., Schmeidler, D.: Maxmin expected utility with non-unique prior. Journal of Mathematical Economics 18(2), 141–153 (1989) 24. Goldstein, I., Pauzner, A.: Demand-deposit contracts and the probability of bank runs. Journal of Finance 60(3), 1293–1327 (2005) 25. Hayes, A.: ZEC position exit announcement. https://x.com/CryptoHayes/stat us/2062723034369458520 (2026) 26. Kappos, G., Yousaf, H., Maller, M., Meiklejohn, S.: An empirical analysis of anonymity in Zcash. In: 27th USENIX Security Symposium. pp. 463–477 (2018) 27. Klibanoff, P., Marinacci, M., Mukerji, S.: A smooth model of decision making under ambiguity. Econometrica 73(6), 1849–1892 (2005) 28. Luo, D., Mishra, T., Yarovaya, L., Zhang, Z.: Investing during a fintech revolution: Ambiguity and return risk in cryptocurrencies. Journal of International Financial Markets, Institutions and Money 73, 101362 (2021) 29. MacKinlay, A.C.: Event studies in economics and finance. Journal of Economic Literature 35(1), 13–39 (1997) 30. Morris, S., Shin, H.S.: Unique equilibrium in a model of self-fulfilling currency attacks. American Economic Review 88(3), 587–597 (1998) 31. Ramos, S., Pianese, F., Leach, T., Oliveras, E.: A great disturbance in the crypto: Understanding cryptocurrency returns under attacks. Blockchain: Research and Applications 2(3), 100021 (2021) 32. Shanaev, S., Shuraeva, A., Vasenin, M., Kuznetsov, M.: Cryptocurrency value and 51% attacks: Evidence from event studies. The Journal of Alternative Investments 22(3), 65–77 (2020) 33. Spanos, G., Angelis, L.: The impact of information security events to the stock market: A systematic literature review. Computers & Security 58, 216–229 (2016) 34. Telang, R., Wattal, S.: An empirical analysis of the impact of software vulnerability announcements on firm stock price. IEEE Transactions on Software Engineering 33(8), 544–557 (2007) 35. Wilcox, Z., Hopwood, D.E., Grigg, J., Caruso, J., McGee, J., Swihart, J.: Security disclosure: We remediated a vulnerability in Sprout. https://forum.zcashcommu nity.com/t/security-disclosure-we-remediated-a-vulnerability-in-sprou t/55180 (2026), accessed 2026-06-06 36. Wilcox, Z., McGee, J., Hornby, T.: The Orchard counterfeiting vulnerability—and next steps. https://forum.zcashcommunity.com/t/56015 (2026), accessed 202606-06 37. Wilcox, Z., McGee, J., Hornby, T.: The Orchard counterfeiting vulnerability—and next steps (X article). https://x.com/zooko/status/2062644925590900980 (2026), posted 2026-06-04 21:17 UTC 38. Zcash Explorer: Mainnet Blockchain Information API. https://mainnet.zcas hexplorer.app/api/v1/blockchain-info (2026), independent node snapshot accessed 2026-06-10 39. Zcash Foundation: Zebra 4.5.3 and 5.0.0: Emergency soft fork and NU6.2 activation. https://forum.zcashcommunity.com/t/55981 (2026), accessed 2026-06-06 40. Zcash Open Development Lab (ZODL): Coordinated Zcash network upgrade underway. https://zodl.com/coordinated-zcash-network-upgrade-underway/ (2026), published 2026-06-02 06:20 UTC 41. Zcash Open Development Lab (ZODL): Orchard vulnerability successfully remediated. https://zodl.com/orchard-vulnerability-successfully-remediated/ (2026), published 2026-06-03 04:09 UTC; accessed 2026-10-15 42. Zcashinfo: Zcash coin-pool API. https://api.zcashinfo.com/api/v1/coin-poo ls/history (2026), accessed 2026-06-07

Related documents

• Pricing the Unprovable: Ambiguity, Turnstile Runs, and the Verifiability Discount in Crypto Protocols#1356876
• Non-Discriminatory Personalized Pricing#302998
• A Graph-Based Analysis of Comparability, Scale, and Attribution in Private Transformer Inference#1354297
• A Graph-Based Analysis of Comparability, Scale, and Attribution in Private Transformer Inference#1335932
• Bundle Security Protocol Specification#501410