Arbitration service

DemoThemis The most ambitious arbitration service ever made

5 min read

The simple version

DemoThemis is a verified-human arbitration service. Anyone can fund the jurors and receive a ruling. When money is involved, an optional protocol escrow can execute it automatically.

The requesting application chooses the jury sizes, possible appeals and deadlines before filing. See what it can configure.

Problem and role

Why applications need a neutral court

From day zero, DemoThemis lets any platform offer a shared dispute resolution service and optional escrow that both the business and its customers can trust, without first reaching the scale to build and run either itself.

Why it exists

A shared court separates the business from the ruling

Existing model
Broken

Dependence creates a conflict

Delegated power

You trust whoever settles the dispute

When you book an Airbnb, take an Uber, buy on eBay, order through DoorDash, or bet online, you are trusting whoever can reverse the payment if the deal goes wrong.

Conflicted control

The decision-maker is usually conflicted

An internal arbitrator works for the organization whose revenue, refund costs, largest customers, or reputation may depend on the outcome. If the jury is token weighted, token voters may also own positions affected by the ruling.

See the Polymarket token-weighted court problems
Protocol model
Fixed

Separation creates shared infrastructure

Escrow separation

Escrow changes the power

When assets are at stake, protocol escrow lets the app provide the interface without controlling the funds or outcome.

Shared scale

A shared court can compound

Many apps can use one arbiter, and the court gets better as more cases create fees, records, and evidence of juror quality.

Case lifecycle

What happens from the initial protocol request to the final ruling

The requesting application fixes the complete jury route before the case opens. The full initial payment accompanies submission and funds the first round before jurors are drawn.

  1. Case and fee are set

    Before the draw, the application sets the question, evidence rules, jury route and result handling. It pays the full initial quote with the submission.

  2. Jurors are drawn

    World-ID humans enter one shared generalist pool. A public source of unpredictable numbers draws one panel, bound to the case. Anyone who does not assess themselves as capable of judging it can decline. The selector then runs again using the original case-bound randomness plus the next unused position. The court reserves a complete compatible set before offering assignments. One accepted assignment blocks other work until that assignment completes, not until the customer case is final. A funded case waits for a full jury instead of shrinking, expiring or refunding its unused fee.

  3. The juror accepts

    The contract checks the enrolled wallet, the selected assignment and its deadline. The juror chooses whether to accept the work and its payment terms.

  4. Votes stay private

    Receipt-free encrypted ballots let the court count the result without revealing or proving any single vote.

  5. Appeals follow fixed case terms

    Before acceptance, every case fixes a finite jury route and declining appeal-funding windows. Each funded appeal draws fresh jurors. Insufficient information is a valid ruling. Any connected escrow follows the result rules accepted at the start.

  6. The ruling returns

    DemoThemis returns a final signed ruling. Connected escrow, if any, releases or refunds by rule. Later accountability does not reopen that ruling.

One assignment, two deadlines
  1. Offer recordedGo available deliberately. Accept within 1 hour.
  2. Acceptance recordedYou have 24 hours to answer or replace your private ballot.
  3. Answer window closesA valid ballot earns the agreed pay and returns your bond. You can take a different case.

Pass or let the offer expire: no penalty. Accept but miss the answer deadline: no pay and the whole bond enters the shared pool once. A replacement takes the work.

The bond is the juror’s own deposit. Both clocks keep running during outages. An answer must reach the chain before the deadline, not merely be typed or sent. Nobody serves twice on the same case.

What if the court is still waiting for answers?

A funded case keeps its money and completed work while missing jurors are replaced. It never becomes an Insufficient information ruling just because people are missing. That answer must come from completed votes. A juror becomes available again when their own answer window closes, not when the customer’s case finally ends.

Court rules

The rules behind the ruling

Court rules

The application sets the terms, not the outcome

Verified enrollment

One person holds one seat, verified through any 3 of 5 identity protocols. Wallet authorization controls its assignments.

A committed draw

Public randomness chooses eligible jurors. Replacements use the next unused positions, not a new draw selected by the requester.

Terms fixed before selection

The route, deadlines and pricing policy are agreed before the first draw. Each selected juror has one vote.

Work can be audited

Appeal-triggered audits assess the juror’s work after finality. The audit can affect pay and eligibility, not the customer’s final ruling.

Follow the court rules, appeals and audits in Fortify The Court.

Juror quality

Protocol quality rewards careful judgment without public vote histories

Juror quality

How the shared court learns juror quality

Agreeing with the majority earns no quality credit. Beta counts final appeals confirming a vote against the juror’s own round and final Careless audits. Its range expresses uncertainty about those counted results. Outside research helps auditors, but cannot directly change Beta. See the exact calculation.

Every case is recordedMarket rulings, delivery disputes and other completed assignments enter the same private service history.
Audit overturned decisionsA juror can privately explain a difficult vote before the result. After customer finality, a funded appeal can trigger fresh auditors to assess earlier juror work.
Count only the defined resultsA qualifying final appeal confirmation or a final Careless audit changes Beta. Outside research helps auditors check the work.
More completed cases do not automatically mean a higher scoreA case can add service history without changing quality. Only the qualifying final appeal and audit results defined below change the estimate. Every selected juror still has an equal vote.
Pay does most of the rewardCareful jurors earn more and get drawn more often, but caps stop any one juror from dominating the pool.

Bootstrap

Any application can bring demand to DemoThemis

DemoThemis does not depend on any one application for demand or funding. Any person or application can submit a well-defined case, pay the full court fee before jurors are drawn, and receive a ruling. Every completed case creates an entry in the shared private juror-quality record.

Continue to Deep dive for the draw, private ballots and an interactive explanation of juror quality.

17 min read, plus interactive examples

Under the hood

Read in order, or choose a section to explore.

Part 1 · Problem and role

Value proposition: neutral arbitration any application can use

You never really trusted the stranger whose spare room you booked through Airbnb. You trusted the arbiter standing behind the deal. Make that arbiter independent and affordable, and more apps can rely on it. Prediction markets need the same neutrality: bettors must trust the court, and token-weighted failures show what happens when it can be bought.

Booking an Airbnb from a stranger and paying before arrival looks reckless on paper. It feels ordinary because Airbnb can refund you, a card issuer can reverse the charge, and reviews punish repeat cheating. The safety comes from the arbiter behind the stranger.

Marketplaces such as eBay, gig apps such as Uber, ad auctions such as Google Ads, app stores such as Apple's App Store, and prediction markets such as Polymarket and Kalshi all outsource dispute resolution to a platform, bank, or token vote. The result can be house owned (the outcome resolution is more likely to resolve in whatever direction favors the interest of the application managing the resolution rather than what is most true or fair), slow, expensive, or buyable by the largest holders like UMA and Kleros. DemoThemis turns that hidden utility into shared arbitration, with optional protocol escrow if applications want us to handle escrow.

A shared court from the first customer

From the first customer, DemoThemis gives any platform customer dispute resolution and optional escrow, even before it has the scale, in-house dispute operation, case history, or capital to build a system people can trust. Businesses get a neutral court they do not have to run, customers get rulings made by jurors rather than the business, and protocol escrow can hold and release funds automatically when money is involved.

One court, many apps

Build the arbiter once, share it everywhere

Any person or app can submit a well-defined case, fund its jurors, and receive an independent ruling from randomly drawn, verified humans. If assets are involved, optional escrow can execute that ruling automatically.

Airbnb · rooms
Uber · rides
eBay · goods
Google Ads · ads
→
DemoThemis courtfunded jurors, random panels, private votes
→
A signed ruling and optional automatic execution
Many apps, one shared arbiter. The court answers to none of them, which is exactly why all of them can use it.

The requesting person or application supplies the case, decision criteria, evidence rules, and juror fee. DemoThemis returns the ruling; when assets are involved, optional escrow can release or refund them by rule. Each customer replaces a private dispute-resolution system with one shared court.

The court fee

Charge a one-time court fee for each case

When a resolution request is accepted, the protocol calculates one court fee using the fee rules in force for that case: processing cost + required panel compensation + contribution to future juror rewards + capped operations charge. The requesting person or application pays it before the draw.

1

Pay follows the work

Juror pay responds to eligible supply, case volume, panel size, expected time, and complexity.

2

Operations has a ceiling

An approved, public budget is recovered only up to a hard per-case cap, never as a permanent revenue share.

3

Appeals are funded separately

Each funded appeal pays once for its new panel and delay. Any refundable appeal deposit is tracked separately from court revenue.

Every court, with or without escrow, collects the full initial work quote before the first draw. Each later appeal needs its own full payment. The application chooses the route. It cannot choose a juror or change accepted terms.

Qualified supply and demand determine juror compensation under the published pricing rules. Those rules can change only between scheduled policy updates, and no application-provided budget, escrow value, or payout rule can reduce the quote for an accepted case. The rate responds to court-wide demand, eligible supply, pending workload, response time, and panel size. Time and complexity bands are recalibrated between policy updates from measured juror service, using medians so no single case can move them.

Part 2 · Court rules

How the court separates responsibilities

The court separates application choices from jury decisions. Verified enrollment, wallet authorization, committed draws, ballot rules and later audits each have a defined role. They are not a guarantee that every ruling is correct.

The requesting application chooses the complete jury route before submission. DemoThemis enforces the agreed route, fees, deadlines and eligibility rules.

The Fortify The Court chapter follows those rules from the first payment to finality and later juror audits.

The wrong foundation

When votes are tokens, verdicts have a price

DemoThemis assigns votes to randomly selected, verified jurors rather than in proportion to tokens held. Each selected juror has one vote.

In token courts like UMA and Kleros, voting weight follows the wallet, so a majority has a market price. Disputed Polymarket resolutions show the problem in practice; the evidence is in the OmenMarketMaker chapter.

That is not merely a bad implementation. If stake is voting power, the protocol works as written when the largest holder wins. An attacker reads the rule as a price list: acquire enough tokens and buy the verdict.

DemoThemis gives each selected juror one vote, regardless of wealth. The 3-of-5 identity check stops one person registering several jurors.

The draw

Pay before the jury is known

If an application could see the selected jurors before committing, it could abandon an unfavourable panel and keep trying until a corrupted group was selected. DemoThemis prevents this by requiring the application to lock any escrow and pay the court fee before the jury is drawn. Once the jury is selected, the case cannot be cancelled or rerolled because of who was chosen. Starting again requires paying for a separate case, while the original case continues.

The jury is drawn using a public random number released at predetermined times, so nobody can choose when it is created or influence its result. If the random used to make the draw was dependent on the time of request then the request could influence the random number output and therefore influence the draw.

Identity and authorization

One verified person, one juror seat

A juror seat needs any three of five independent identity protocols. No single protocol can create or block a juror. No juror has to show a government ID. The enrolled wallet authorizes acceptance and answers for the selected assignment.

  • World IDiris
  • ZKPassportpassport chip
  • Humanity Protocolpalm vein
  • Alienface
  • Humanodeface

Any 3 of 5one juror seat

One person has one set of three. A seat ends when its credentials do.
  1. Verify enrollmentCheck three identity proofs and prevent duplicate enrollment.
  2. Authorize the walletCheck that it may act for this juror.
  3. Check the assignmentAccept an answer only for the selected case and before its deadline.

The ballot

Encrypted ballots and private replacement

A vote buyer pays only when they can prove delivery. Commit-and-reveal fails because the juror publishes a vote hash and later opens it: the same receipt that proves honesty to the protocol proves obedience to a briber.

DemoThemis instead encrypts every ballot with a shared encryption system and lets the juror silently replace it without any public sign. This allows jurors to change their decision until voting closes for better arbitration and allows bribed voters to change their vote at any time before voting closes, which adds an extra layer of difficulty to bribing jurors.

Ballots are then added while they remain encrypted. Only the aggregate total opens, with a zero-knowledge proof that the count followed the rules; no individual ballot opens, even to tally operators. This is stronger than hiding a public vote behind an administrator. The design calls for a verifiable total without publishing individual answers.

Each case gives every juror a new anonymous identifier. Anyone can verify that every seat belongs to a unique, eligible human, but cannot link that juror to their activity in other cases.

What a briber can see, on purpose

The anonymous identifiers drawn for one case, so anyone can audit the draw against the public source of unpredictable numbers.
Proof that every seat is unique, eligible, and selected fairly. Draw weight is proved from a private reputation band, never a public score.
The final tally, with its proof attached.

What the protocol does not reveal

A juror's name or biometric data. A seat uses a case-specific identifier.
Which way any seat voted, on any case, ever. Only the tally decrypts.
Any juror's exact penalty balance, reputation, case history, individual payment, debit, or appeal refund.
Proof of a bought vote, even from a juror trying to sell one.
The split is deliberate. The public gets one-case anonymous identifiers, aggregate accounting, and proofs that the rules were followed; it never gets the private history that could turn a penalty or payment into a vote receipt.

No administrator key is allowed. Setup must be distributed or keyless, so independent participants create the capability together without one party holding it; initialization artifacts become unusable afterward; and the sole output is an aggregate tally with a public zero-knowledge proof. A party that creates, holds, or merely promises to delete a complete key breaks the guarantee.

Privacy continues after tallying. Exact scores, penalty balances, rewards, and refunds stay inside private records whose rules can still be proved. Zero-knowledge proofs reveal only what is needed now, such as an eligible reputation band or a valid private account update, while batched totals prove the money balances. A public payment or penalty tied to a seat would recreate the receipt. One limit is plain arithmetic. A unanimous tally shows how every juror on that panel voted, and no ballot design can hide that.

Application configuration

Applications set the terms. DemoThemis draws the jurors.

The application chooses the question, complete jury route, spending authorization, result handling and appeal-funding windows before acceptance. The route can repeat or decrease in size. The protocol selects the jurors and enforces the accepted terms. See the configuration guide.

Part 3 · Juror quality

Protocol quality: how careful jurors earn more responsibility

Every completed case adds private service history. Qualifying final appeal confirmations and final Careless audits change the juror’s Beta score.

DemoThemis uses Beta to estimate each juror’s quality from their private case history. Appeals and audits of overturned decisions supply evidence for that history. The score can affect future pay offers and the chance of receiving work, not the strength of a selected juror’s vote. A permanent ban requires the top of the approved 95% uncertainty range to be below 70%, enough real case evidence and completed audits.

Why shared history compounds

Private history improves quality without exposing jurors

Each completed case creates two records. A signed receipt proves the final ruling and any connected settlement to the customer. A private juror record stores service and the results used in Beta. The juror can read their own record. Auditors receive the evidence needed for their task. Other people see only a quality band or proof that the juror qualifies, not individual votes or earnings.

The grader's paradox

Why majority agreement cannot measure judgment quality

Grade jurors on matching the majority and the safe strategy becomes guessing the room instead of reading the case. The diagram shows how a wrong consensus can produce perfect-looking scores.

  1. 1 Scoring rule

    Reward agreement

    A juror’s score rises whenever their vote matches the panel majority.

  2. 2 Incentive

    Predict the room

    Following the expected majority becomes safer than independently judging the case.

  3. 3 Panel behaviour

    Independent signals disappear

    Jurors converge on the same answer, including when the shared answer is wrong.

  4. 4 False signal

    The scores look perfect

    Agreement rises because everyone herds, not because the court identified good judgment.

The failure reinforces itselfPerfect-looking scores make the original rule appear successful, so the court keeps rewarding agreement.
The metric creates the behaviour that makes the metric look successful. High agreement can therefore hide low-quality judgment.

This is not a rare edge case. Once agreement determines careers, independent judgment adds risk but no reward. DemoThemis therefore does not use agreement with the first majority to grade jurors. Only qualifying final appeal confirmations and final Careless audits change Beta. Outside research helps auditors assess the original work. It cannot write quality credit directly. The loop chapter explains how completed cases build that private record.

Audits and quality

An overturned answer is not proof of careless work

Auditors assess a juror's own work after the case is final. Only a final Careless assessment can add that audit's negative quality result. Reasonable and Insufficient information add neither credit nor a penalty. Follow the audit, its funding and the one paid repeat audit in Fortify the Court.

Repeat-audit payment and refundable deposit.

One court

Every case contributes to one private quality record

Every case uses the same random draw, private ballots, appeal ladder, and juror-quality system. The question and decision criteria are fixed before the draw, and every final case creates a private record that later quality evidence can update.

A published market price or delivery receipt can help an auditor check the juror’s explanation. It does not directly change Beta. The same scoring rules apply to every kind of case.

Every completed assignment enters private service history. Only the two final results defined below enter the scoring history. Agreement with an unchallenged majority earns no quality credit.

How can this case add quality evidence?
…

The court does not route cases into separate accuracy systems. It records the evidence each case can provide, then updates one shared juror-quality history.

The reputation dial

Beta estimates quality from a juror’s case history

Beta is the chosen model, not Wilson or a combination of the two. It calculates a range of possible quality levels from the case results that the court allows into a juror’s record. The average gives one estimate. The 95% range shows how uncertain that estimate is under the model. It does not mean there is a 95% chance that the latest verdict was right.

What changes Maya’s calculation?

Appeal-confirmed cases
Maya voted against her own round’s ruling. A later appeal made her answer final. Count one case.
Careless-work cases
A final audit found Maya careless, after the challenge process. Count one case.
Everything else
Ordinary completed work, Reasonable and Insufficient information audit answers add neither kind of result.

Use up to 100 scored cases, ordered by original completion. Each contributes once, without age weights. A final Careless result wins if both kinds exist for the same case.

Beta adds two starting amounts of 1, once. They are assumptions, not completed cases. Their sum is the 2 below.

Beta average =
  (1 + appeal-confirmed cases)
  ÷ (2 + appeal-confirmed cases + careless-work cases)

The average describes these counted results, not the percentage of every verdict Maya got right. The model’s middle 95% range leaves 2.5% below its lower end and 2.5% above its upper end.

One case, and how corrections work

Maya votes NO. Her round rules YES. A later appeal finally rules NO. With no other scored history, this gives one confirmation and no Careless result: (1 + 1) ÷ (2 + 1 + 0) = 66.7%. The confirmation-only protection below keeps her pay and selection rates at least 1.

Auditor votes are not separate scored cases. Separate cases count individually even when they concern the same event. A newly finalized result takes its place by the original case-completion date, not the audit date. Remove older contributions beyond the latest 100. A permitted correction replaces a contribution, rather than adding another. Removing a Careless result restores a still-valid appeal confirmation at its original date. Keep both source records. This does not reverse a permanent ban, refund a settled deduction or let a new wallet erase debt.

Future offers use the Beta average
Beta averageSelection weightPay multiplier
Below 70%0.50.75
70% to below 80%11
80% to below 90%1.51.25
90% or more21.5

Base pay is the assignment price before this multiplier. Selection weight is relative to a new qualified juror’s 1. Weight 2 is not two votes or a guaranteed chance of selection. With no scored cases, both rates are 1. With confirmations but no Careless case, neither falls below 1. The first scored result affects future offers. Accepted pay and equal votes never change.

The three-times draw cap matters because court security comes from a wide active pool, not a small class of stars. Accuracy still compounds into more work and private income, but no juror dominates selection.

Court fees fund future juror rewards

The shared juror reward pool pays weekly rewards to jurors who meet the quality and recent-work requirements below. Part of each court fee continues to fund the pool, however large its balance becomes. The published pricing formula sets the contribution.

Each week, the software allocates up to 40% of new pool income left after committed costs and recovery of earlier losses. This is not 40% of the accumulated balance. At least 60% of that net new income stays in the pool before later costs. A loss-making week creates no new rewards. Money already owed or committed cannot be distributed. Qualifying jurors share the rewards by the quality weights above, with individual payments kept private.

This week’s money, not the whole pool
  1. Example: $1,000 incomeNew money the pool may finally keep
  2. Minus $200 costs$800 remains, assuming no earlier loss
  3. $320 rewards$480 retained. Allocate 40% if enough money is available.

Jurors share rewards by the selection weights above only with 10 scored cases, a lower 95% endpoint of at least 70%, and completed work in the past 7 days. Allocated claims never expire.

Losses, existing promises and the exact payment limit
Start with new income the pool may keep this week.
Subtract pool-funded costs once, when committed.
Cover losses still unrecovered from earlier weeks.
If nothing remains, allocate no new rewards.
Otherwise, calculate 40% of the remainder.
Pay no more than money not already owed or committed.
If nobody qualifies, allocate nothing.

An earlier uncovered loss of 300 reduces this example’s 800 to 500. Allocate 200 and retain 300, not another 320. Retained balances, internal transfers and unpaid debts are not new income. Earned pay, refundable deposits, unfinished audit funding and allocated but unclaimed rewards are already spoken for. There is no extra per-person reward cap. Later costs can still shrink the pool.

The same pool covers increases and receives savings when a replacement accepts work.

An appeal can also require a refundable security bond, separate from its fee. At finality, the bond returns if the final ruling differs from the ruling that appeal challenged. Otherwise it enters the shared pool. Public proofs verify correct accounting without revealing individual payments.

Direct accountability

What a juror’s quality record changes

Beta changes future pay, selection and eligibility. It never changes the strength of a selected juror’s vote. Audit deductions are separate and are explained with the audit in Fortify the Court.

Careless-work deductions and the earnings-based cap.

Try Beta on one juror’s example history

Selected rules, invented history: start with 1 and 1, count each scored case once, and show the middle 95% range. This is an illustration, not a real juror’s record.

40 cases
31 cases

The other 9 cases each have a completed audit that found this juror’s work careless. These 40 cases come from their service history, not one audit. Cases with no scoring result are excluded from this example.

Enable JavaScript to calculate this example.

Example Beta estimateCalculation unavailable
Separate from the score A careless-work charge needs a final audit The charge follows the audit payment rule in Fortify The Court. A lower Beta average is not a charge.
Future payCalculated belowAccepted work keeps its agreed pay
Chance of selectionCalculated belowSelection weight stays within the 3× cap
Strength of each voteOne equal voteFor every selected juror, regardless of score
Ban range test onlyCalculation unavailableAt least 10 scored cases and completed audit challenges also required

Lenient on purpose

A permanent ban requires confident evidence of poor performance

The Beta range is only one requirement for a permanent ban. Its top end must be strictly below 70%. A top end equal to 70% does not pass. The juror must have at least 10 scored cases, with all applicable audit challenges completed. This minimum limits bans, not when an audit may start. A short history or one overturned verdict is not, by itself, proof of careless work.

Future pay offers and the chance of selection can change before a permanent ban is justified. A completed audit can also support a separate careless-work charge. Neither consequence requires making one selected juror’s vote weaker than another’s.

A juror who voted against the original majority receives quality credit when a final appeal confirms that vote. A juror on the overturned side loses quality only if a completed audit establishes careless work that applies to them. Auditors judge the evidence available at the time. They cannot treat a missing explanation or reasonable disagreement as carelessness. The update does not publicly identify the juror.