LACUNARY

The read is one account load and two subtractions. Deserialise SlotHashes, take the slot number of the first entry and the slot number of the last, subtract to get the span, subtract the fixed entry count from the span to get the skipped count, and divide. There is no loop over the entries, no hashing, and no comparison beyond the arithmetic, so the cost is a fixed few hundred compute units regardless of how bad the interval was.

The sysvar is written by the runtime as part of block production and no program can write to it. This is the property that makes the number worth using. A figure supplied by an oracle is a figure someone can be paid to misreport, and a figure computed inside the program from data the program was handed is a figure that inherits whatever was wrong with the data. This one is a side effect of consensus and it exists whether or not anyone is reading it.

Solana divides time into slots of roughly four hundred milliseconds and assigns each one to a leader in advance through the leader schedule. The leader is expected to produce a block. When it does not, for any reason, the slot passes and nothing is recorded against it. The chain moves on to the next leader and the slot number is simply absent from the record of blocks that exist.

Skips happen constantly and at varying rates. Ordinary conditions produce a small percentage. Congestion, client bugs, upgrades in progress and individual operators with hardware problems all raise it, sometimes sharply and briefly. None of this is unusual, none of it is a sign that anything is broken, and none of it is under anyone's control in the aggregate. It is the background failure rate of a large distributed system doing real work, and the program treats it as exactly that.

The split is a clipped linear map from skip rate to burn share, with the clip at ten percent. Linear rather than curved because there is no argument for curvature that does not amount to a preference about which outcome should be favoured, and the program is not supposed to have one. Clipped rather than unbounded because shares have to sum to one.

The choice of ten percent for the reference is the only judgement call in the design and it is worth naming as one. It was set by looking at where the distribution in Figure 4 thins out, so that ordinary intervals produce a mixed split and genuinely bad ones saturate. A lower reference would push the system toward burning most of the time. A higher one would push it toward locking. There is no instruction that changes it and no path by which it can be revisited, which is the only guarantee that matters about a number chosen by a person.

settle is permissionless and takes no arguments. Every account it touches is a program derived address checked against its seeds before anything moves, the cycle index and the vault balance are read from state rather than passed in, and the window comes from a sysvar. An instruction that accepts no parameters cannot be called with the wrong ones.

It reverts if the vault is empty and it reverts if fewer than the minimum interval of three thousand six hundred slots have elapsed since the last settlement, which is roughly twenty four minutes. The interval exists to stop the state being advanced repeatedly inside a short span, not to schedule anything. Beyond that the timing is open, and whoever calls it pays the transaction fee and receives nothing at all.

Because the caller chooses when to call, the caller chooses which window gets measured. This is a real discretion and it is worth stating plainly rather than leaving for someone to find.

What it is worth is bounded. Proposition 1 caps the movement from any single additional skip at under two percentage points, so shifting the split meaningfully requires waiting for an interval that is genuinely bad across hundreds of slots, and such intervals are visible to everyone at once rather than being something one party can arrange. More importantly the caller has no stake in the outcome. There is no reward for calling, both legs of the split benefit holders equally, and a holder who prefers one leg over the other is expressing a view about the asset rather than extracting from it. The discretion exists, it costs a transaction fee to exercise, and it cannot produce an outcome that removes anything from the coin.

Running a validator does not help. Skips are counted in the aggregate across whatever leaders held the slots in the window, and a single operator failing deliberately adds one gap at a time against a span of several hundred, which Proposition 1 prices at under two percentage points each. Producing enough failure to move the split requires failing across a large share of the network's leaders, which is not something an individual holds the ability to do and not something that can be purchased.

Watching for a favourable window helps marginally and costs a fee, and the previous section describes what it is worth. Precomputation helps not at all, because the window is written by the runtime slot by slot and does not exist before the slots do. There is no advantage to size, no penalty for being small, and nothing to run. The program reads a number the network was going to produce anyway and spends against it, and the only thing anyone can do about that is decide whether to hold the coin.