Threat Model

This section describes the adversarial assumptions under which KnoxNet operates and analyzes the system's behavior against relevant threat classes. KnoxNet is designed to tolerate adversarial behavior during offline execution while preserving global correctness and bounded economic risk through reconciliation and enforcement.

10.1 Adversarial Capabilities

KnoxNet assumes adversaries with the following capabilities:

• The ability to control one or more user devices

• The ability to execute arbitrary offline transactions, including conflicting or malicious histories

• The ability to delay or withhold reconciliation submissions

• The ability to observe and analyze globally visible network activity during online settlement

• The ability to collude with other adversarial participants

Adversaries are not assumed to have the ability to break standard cryptographic primitives, including digital signatures, hash functions, or encryption schemes.

10.2 Network-Level Surveillance

KnoxNet is explicitly designed to reduce exposure to network-level surveillance.

During offline execution, transactions are not broadcast over public networks and do not interact with shared infrastructure. As a result, adversaries observing internet traffic, RPC endpoints, or blockchain mempools cannot observe transaction execution or derive metadata such as timing or frequency of offline transfers.

During online settlement, encrypted enforcement ensures that observers cannot infer transaction amounts, balances, or detailed accounting structure from reconciliation submissions.

10.3 Double-Spending and Conflicting Histories

Adversaries may attempt to double-spend offline notes by executing multiple conflicting transactions while offline.

KnoxNet does not attempt to prevent such behavior in real time. Instead, conflicting use of the same offline note identifiers is deterministically detectable during reconciliation. Upon detection, fraud proofs are generated and penalties are applied automatically.

This design ensures that double-spending is detectable and punishable, even if it is not prevented at the moment of execution.

10.4 Denial of Reconciliation

An adversary may attempt to avoid penalties by refusing to reconcile or by indefinitely delaying reconciliation submissions.

Such behavior does not compromise system integrity. Unreconciled offline notes cannot be redeemed on-chain, and escrowed $KNX remains locked. This creates a strong incentive for reconciliation, as withholding reconciliation only harms the adversary by rendering offline value unusable.

10.5 Collusion and Witness Abuse

Adversaries may collude to provide false witness attestations during offline execution.

Witness attestations are optional and non-authoritative. They do not determine transaction validity and cannot override deterministic reconciliation outcomes. If witness attestations are used in conjunction with staking, false or contradictory attestations are detectable and punishable during settlement.

Collusion among witnesses does not allow adversaries to bypass global enforcement or inflate supply.

10.6 Key Compromise and Device Loss

If a user's private key is compromised, an adversary may gain the ability to authorize offline transactions using that key.

This threat is inherent to all systems based on cryptographic authorization. KnoxNet mitigates the impact of such events through bounded exposure: the maximum value at risk is limited by escrowed $KNX and optional device-level issuance caps.

Recovery and revocation mechanisms may be implemented at the application layer but are outside the scope of the core protocol.

10.7 Limitations and Non-Goals

KnoxNet does not attempt to protect against:

• Adversaries with complete physical control over a user and their devices

• Side-channel attacks on device hardware

• Coercion or forced disclosure of private keys

• Permanent network partition without eventual reconciliation

These threats are acknowledged but considered outside the scope of the protocol's design goals.

10.8 Summary of Threat Coverage

KnoxNet is designed to tolerate adversarial behavior during offline execution while preserving global correctness, bounded loss, and reduced observability. By shifting enforcement from real-time prevention to deterministic post-execution verification, the protocol accepts temporary inconsistencies in exchange for stronger privacy guarantees and resilience under adverse conditions.