Last week we described how PolitiCap regional nodes pull software and data instead of receiving pushes. That closed one class of risk: unowned hosts never get our deploy keys.
It left another open. What if the local operator turns hostile and simply inserts fake fills into the regional database, then lets the trade batch upload ship them to the hub?
The answer is the same spine that already moves money on the 3DN family stack: the DutchBud ledger. Every syndicated fill must carry a banking receipt. No seal, no accept.
The attack in one picture
If an operator controls the regional host, they control the local MySQL and the node API key. Signing with a key that lives on the same box does nothing — they can forge anything the box would sign. The only durable proof is a receipt minted where money already lives: DutchBud’s closed-loop ledger of virtual credits (dibs).
How a real fill travels now
- Match — MarketMaker or Broker crosses on the regional API (local tape).
- Seal — DutchBud records the notional legs and returns
ledger_ref+ledger_code(HMAC bound to symbol, quantity, price, parties, reference). - Outbox — only rows with both fields are queued for batch upload. Unsigned inserts are ignored for syndication.
- Hub ingest — for each batch line the hub asks DutchBud to verify and consume the receipt once. Mismatch, missing seal, or replay → reject.
Trust perimeter
Minting stays on the banking role — the highest trust perimeter in our fintech stack. Regional nodes may request a seal through the internal banking API the way production already seals MarketMaker capital; they cannot invent a valid ledger_code without that perimeter.
The hub does not mint either. It only verifies. That keeps infrastructure honest: managed hosting edges can be less trusted than the money plane without breaking multi-city markets.
| Claim | Who can fake it on a hostile node | What the hub does |
|---|---|---|
| Outbox row | Operator | Ignore without receipt |
| Node API batch | Operator with node key | Verify each line with DutchBud |
| DutchBud receipt | Only banking perimeter | Accept once, bind fields, consume |
| Two sockpuppets who really pay | Real money movement | Different controls (standing, limits) |
Why this fits digital sovereignty
3DN builds infrastructure and compute for operators who want control without chaos. Regional markets are a form of digital sovereignty: a city can run its edge, but it cannot rewrite the family money story by editing a local table.
Pull closed the deploy channel. Ledger receipts close the fake-tape channel. The net is tighter — not because we trust every box, but because we stopped asking boxes to be banks.
Read the companion architecture piece: Pull, don’t push: how PolitiCap regional nodes update themselves.
Engineering continues in production: expand-only migrations, GitLab-tracked APIs, and ops metrics for software version and hello age. Schema version on the dashboard is next; money was the sharper edge.
Leave a Reply