DemoThemis The most ambitious arbitration service ever made

Booking an Airbnb from a stranger and paying before arrival looks reckless on paper. It feels ordinary because Airbnb can refund you, a card issuer can reverse the charge, and reviews punish repeat cheating. The safety comes from the arbiter behind the stranger.

Marketplaces such as eBay, gig apps such as Uber, ad auctions such as Google Ads, app stores such as Apple's App Store, and prediction markets such as Polymarket and Kalshi all outsource dispute resolution to a platform, bank, or token vote. The result can be house owned (the outcome resolution is more likely to resolve in whatever direction favors the interest of the application managing the resolution rather than what is most true or fair), slow, expensive, or buyable by the largest holders like UMA and Kleros. DemoThemis turns that hidden utility into shared, unbuyable arbitration, with optional protocol escrow if applications want us to handle escrow.

Better-than-world-class dispute resolution from day -1

From day -1, DemoThemis gives any platform better-than-world-class customer dispute resolution and optional escrow, even before it has the scale, in-house dispute operation, case history, or capital to build a system people can trust. Businesses get a neutral court they do not have to run, customers get rulings neither side can buy, and protocol escrow can hold and release funds automatically when money is involved.

One court, many apps

Build the arbiter once, share it everywhere

Any person or app can submit a well-defined case, fund its jurors, and receive an independent ruling from randomly drawn, verified humans. If assets are involved, optional escrow can execute that ruling automatically.

The requesting person or application supplies the case, decision criteria, evidence rules, and juror fee. DemoThemis returns the ruling; when assets are involved, optional escrow can release or refund them by rule. Each customer replaces a private dispute-resolution system with one shared court.

The court fee

Charge a one-time court fee for each case

When a resolution request is accepted, the protocol calculates one court fee using the fee rules in force for that case: processing cost + required panel compensation + contribution to future juror rewards + capped operations charge. The requesting person or application pays it before the draw.

Every court, with or without escrow, prepays its complete work quote. Case value may determine how much protection Automatic Mode requires, but it never caps juror compensation or the court fee. An application either funds the exact quote or no case opens; every accepted quote freezes before the draw, whether the setup is Automatic Mode or Manual Mode.

Qualified supply and demand determine juror compensation under the published pricing rules. Those rules can change only between scheduled policy updates, and no application-provided budget, escrow value, or payout rule can reduce the quote for an accepted case. The rate responds to court-wide demand, eligible supply, pending workload, response time, and panel size. Time and complexity bands are recalibrated between policy updates from measured juror service, using medians so no single case can move them.

Every case is requested in one of two modes. In Automatic Mode, DemoThemis picks the jury size and appeal route that keeps an attack unprofitable, then quotes the fee. In Manual Mode, the requesting application picks them itself. Both modes run the same six protections; the mode only decides who sizes the court.

To really understand how DemoThemis is bullet proof, go to the Fortify The Court chapter. Its Attack Simulator lets you raise attacker pressure, switch individual protections off, and see where capture becomes possible.

The wrong foundation

When votes are tokens, verdicts have a price

Token courts like UMA and Kleros sell the gavel to the deepest pocket. This court seats verified humans instead: one verified person per seat, a die nobody can re-roll, a face check that proves a real person is voting, and a ballot that cannot prove how it voted. Buying it means buying people, one at a time, in the dark.

In token courts like UMA and Kleros, voting weight follows the wallet, so a majority has a market price. Disputed Polymarket resolutions show the problem in practice; the evidence is in the OmenMarketMaker chapter.

That is not merely a bad implementation. If stake is voting power, the protocol works as written when the largest holder wins. An attacker reads the rule as a price list: acquire enough tokens and buy the verdict.

DemoThemis swaps the foundation to one human, one vote. Every seat is backed by a World ID that no wallet can mint twice or exchange can sell in bulk. An attacker must recruit people separately, keep them present, land them in a sealed draw, and somehow enforce their private votes. All six protocol protections apply to every funded case at once.

The draw

An application cannot see the jury before committing and paying and why it matters

If an application could see the selected jurors before committing, it could abandon an unfavourable panel and keep trying until a corrupted group was selected. DemoThemis prevents this by requiring the application to lock any escrow and pay the court fee before the jury is drawn. Once the jury is selected, the case cannot be cancelled or rerolled because of who was chosen. Starting again requires paying for a separate case, while the original case continues.

The jury is drawn using a public random number released at predetermined times, so nobody can choose when it is created or influence its result. If the random used to make the draw was dependent on the time of request then the request could influence the random number output and therefore influence the draw.

Application configuration

Applications configure the case; DemoThemis chooses and protects the jury

The application requesting arbitration, like a prediction market, configures the court settings for a case before DemoThemis accepts the case: which mode to use, the value at stake, the most it will pay in fees, whether the ruling also releases escrowed funds, and how long each appeal window stays open. None of it can change afterwards. The How to Make the Court Unbuyable tab lets you set each one and watch the jury and appeal route change with it.

DemoThemis does not grade a juror from one result or simply reward them for following the majority. Across many cases, it uses appeal outcomes, blinded audits of difficult decisions after reversals, and later evidence when available. Strong records gradually increase pay, draw rate, and earned voting responsibility; weak records reduce them. A permanent ban is the final step and occurs only when the entire 95% confidence interval falls below 70%, showing persistently poor performance rather than one bad run.

Why shared history compounds

Private history improves quality without exposing jurors

Each completed case creates two different records. The first is a signed receipt for the customer using DemoThemis, such as an application layer like OmenMarketMaker. It proves the final ruling and, when escrow is used, that the funds followed it. The second is a private grading record used only by the protocol. It records which jurors served, each juror’s private decision, whether an appeal changed the ruling, and whether later evidence supported it. No person or application can read this record; the protocol reveals only the minimum reputation band or eligibility proof needed for a future action.

The grader's paradox

Why majority agreement cannot measure judgment quality

Grade jurors on matching the majority and the safe strategy becomes guessing the room instead of reading the case. The diagram shows how a wrong consensus can produce perfect-looking scores.

This is not a rare edge case. Once agreement determines careers, independent judgment adds risk but no reward. DemoThemis therefore does not use agreement with the first majority to grade jurors. It waits for stronger evidence from appeals, blinded audits after reversals, and later independent outcomes when available. The loop chapter explains how completed cases build that private record.

Appeal-triggered audit

The audit that grades overturned decisions

Most verdicts need only a vote. When the answer is not obvious, a juror may commit a private explanation with their ballot; it is opened only if an appeal overturns the panel. Its main purpose is to let jurors defend a careful decision during the audit that follows an appeal reversal.

An appeal overturning a panel is the only trigger for an audit. Two auditors drawn from the whole juror pool judge the overturned decision once, blind, from the case’s own evidence file. The seated majority decides, and a tie seats a third auditor. The winning appeal pays the audit’s fixed cost, refunded whenever an appeal fails, so the reward pool never funds the auditors and only receives. A juror whose penalty stands can fund one do-over with a returnable deposit, and after it the finding is final forever. Penalties and forfeited deposits flow to the shared juror reward pool. A missing explanation never counts against a juror, and hidden calibration files built from real past cases enforce that rule. Follow one juror, call her Maya, through the two machines below, and take a reviewer’s seat yourself.

One court

Every case contributes to one private quality record

Every case uses the same random draw, private ballots, appeal ladder, and juror-quality system. The question and decision criteria are fixed before the draw, and every final case creates a private record that later quality evidence can update.

A market result may later provide independent confirmation. Delivery disputes and community-standard cases can contribute appeal outcomes and blinded audit findings when challenged. The available signals vary, but they all update the same private history.

Scores use appeal outcomes, audits of difficult decisions after reversals, and later independent evidence when available. No first majority becomes automatic truth.

The reputation dial

Reputation is a private estimate with uncertainty

Quality findings from appeals, blinded audits, and later independent evidence form a private reputation record. Mathematically it is a beta distribution: a best estimate plus an honest error bar, not one naked percentage. An 80% record over 12 findings is therefore not treated like 80% over 140.

The system carries a 95% interval over a rolling window of the latest 50 to 150 cases. Neither the exact score nor its case history is published; a juror proves only the band or threshold needed for the current action. The table shows what that private dial may change.

The three-times draw cap matters because court security comes from a wide active pool, not a small class of stars. Accuracy still compounds into more work and private income, but no juror dominates selection.

Court fees fund future juror rewards

The shared juror reward pool pays periodic private rewards to jurors who prove they meet quality and recency gates. Part of each court fee contributes to this pool only while it is below its published funding target. Once the target is reached, that part of the court fee falls to zero.

An appeal can also require a refundable security bond, separate from its fee. The bond returns when the appeal succeeds; when it fails, the bond is forfeited and can add to the reward pool. Only the pool total and proof of correct distribution are public, so the reward cannot expose or bend one verdict.

Direct accountability

Private penalties make careless voting unprofitable

After all appeals are complete, the protocol charges any penalty to the juror’s private wallet. If the wallet does not contain enough funds, the juror’s World ID–linked account goes negative. Future jury earnings repay the debt first, and changing wallets cannot erase it. The penalty amount depends on current juror pay, unresolved workload, and the expected cost of errors caused by careless voting. This makes random or lazy voting unprofitable while the longer-term quality record gradually adjusts pay, draw rate, vote weight, and eventually eligibility.

Lenient on purpose

A permanent ban requires confident evidence of poor performance

Permanently banning a juror after one rough stretch would reward safe majority guesses. Rational jurors would avoid hard positions and follow the apparent room. A permanent ban therefore occurs only when the full interval is below 0.70, meaning the evidence is confidently and persistently poor.

Leniency at that last gate is not softness everywhere. Private pay, draw rate, vote weight, and audit-confirmed penalties respond earlier; only their aggregate transfer is public. Low effort becomes unprofitable before uncertain evidence ends a career.

When an appeal overturns a panel, an original dissenter who matched the successful appeal gains positive evidence. Jurors on the overturned side lose quality only when the blinded audit finds that their optional explanation failed to support a reasonable judgment from the original evidence. Reasonable disagreement is not treated as careless work, and no public update identifies any juror.