The Wash Trader's Second Hill
Version 0.5 of the paper made two changes at once. The five percent of every fee that earlier versions burned now goes to the Network Steward, and the Steward stopped being a treasury and became a rule: its only act is to post bounties, prepaid offers to buy bandwidth on routes that do not exist yet. One of its programs is the second bridge. Wherever a link is the only way across a gap and carries fees, the Steward offers a bounty for a second path through a different place on the map, so that a sole bridge's toll becomes the money that funds its competitor.
The same day, the rules were written as code for the first time: a simulator in the kit that runs the paper over the five installations from the field notes, with every payment counted. Its first job was to attack the rule it had just been given. It broke it within the hour.
The attack
The paper's defense against fake traffic is that paying yourself loses money. Five percent of every fee leaves the payer's reach, and the Steward can match a payer's own bounty only below that five percent, so a wash trader who runs the payer, the relay and the Mint in one hand loses the difference on every dollar it sends to itself. That part held: at the paper's defaults the trader loses two and a half cents a dollar, and no match multiple up to three times the fee turns it positive.
The second-bridge program did not hold. As written, the bounty was "sized from the fees the sole link carried." A wash trader whose own link is a sole bridge saw a bounty posted for a second path around it, worth the whole of the fees its own traffic had paid. The map stops a second key on the same hill, because the route has to pass through a different place. It does not stop a second hill. The trader built an anchor on a second place it also owned, moved its own traffic across, and collected. Net: about eight cents gained on every dollar it washed. The protocol cannot see ownership, and the paper says so in Section 10, so nothing in the rule could tell the trader's second hill from a neighbor's.
The cap
Two changes closed it, and both are now in the paper. The second-bridge bounty is sized from the Steward's income on the sole link, five percent of its fees, not the fees themselves. And the condition in Section 3.3 is enforced at every payout rather than only in the match: the Steward never pays out, on receipts whose payer is a given identity, more than the fee fraction less a margin of what that identity has paid in, whichever program posted the bounty. That needs no view of ownership, because every Steward payout is against a receipt and every receipt names its payer. Splitting traffic across several identities gains nothing, since the caps add up to the same bound.
What it says about the method
Every version of this paper has had rules that were argued about. This is the first one that was broken by being run. The simulator is a few hundred lines that do nothing the paper does not say, and that is the point: writing a rule so that a program can execute it forces every "sized from the fees" to become a number, and the number was wrong. The same run left thirty-four smaller ambiguities in a notes file, each with the section it came from, which is the honest list of what the prose had been hiding.
The cap is a better rule than the one it replaced, and not only because it closes this hole. It says in one sentence what Section 3.3 was reaching for: nobody gets back from the Steward as much as the Steward took from them, whatever the Steward was doing with it. The three programs can be as clever as the map allows, and the sentence still holds.
The simulator and its scenarios are in the kit at sim/; python3 -m sim.attacks wash prints the sweep this note's figure is drawn from, and python3 -m sim.tests runs the twenty-nine tests, which now include the trader never turning positive.
Sources: the Bandwidth Swap whitepaper, v0.5 (Section 3.3 for the fee and the cap, Section 7 for the Steward's three programs, Section 10 for what the protocol cannot see), the simulator and its NOTES.md, Follow the Bytes, Follow the Money for the installations it runs.