►
Description
Mark Miller explains how ERTP, the Electronic Rights Transfer
Protocol, supports such rich composition for electronic rights
(erights) and smart contracts. Generic smart contracts --- escrow,
derivatives, auctions, etc --- are independent of the kinds of erights
they manipulate. We reify the ability to participate in each contract
as tradable erights that such generic contracts manipulate. We can
understand the resulting power as an extension of the higher-order
programming of functional and object-oriented programming, but applied
to the richer domain of tradable erights.
A
Property
rights
evolved
from
very
simple
concept
that
I
there's
physical
goods
and
there's
a
territory
which
became
tradable
land,
and
you
traded
this
thing
for
that
thing,
and
it
probably
started
without
even
a
general
concept
that
all
these
different
things
were
under
a
common
concept
of
property,
but
as
people
traded
one
thing
for
another,
there
came
to
arise
this
general
understanding
that
oh,
these
are
tradable
things.
There's
this
concept
of
property.
A
And
then,
as
people
built
institutions,
you
know
evolved,
as
institutions
grew
institutional
arrangements,
ways
of
transacting
with
each
other
grew
around
the
concept
of
property
that
was
created.
This
richness,
this
vocabulary
of
ways
of
cooperating
with
each
other
that
were
parameterised
by
whatever
would
feed
into
those
Arrangements
under
the
label
property.
A
So
in
computer
science,
this
process
of
building
up
a
variety
of
abstractions
that
are
generically
parameter
risible
over
some
category
of
input
is
known
as
parametric
polymorphism
and
the
ability
to
take
new
concepts
and
fill
fit
it
into
an
old
category
so
that
parametric
things
things
that
were
generally
parameterize
Abul
could
apply
to
them
is
known
as
reification,
so
Hernando
DeSoto
in
the
the
book.
The
mystery
of
capital.
A
Examines
why
it
is
that
the
informal
economy,
the
economy
that
exists
outside
of
formal
legal
systems,
he
examines
nature
of
that
economy.
First
of
all
explains
that
it's
a
very
rich
economy,
it's
general!
It's
a
genuine
econ
economy.
A
tremendous
fraction
of
the
world's
overall
economic
activity
occurs
outside
of
any
legal
system
occurs
in
the
informal
economy.
There's
certainly
much
creation
of
wealth,
much
cooperation
there,
but
they're
not
able
to.
A
A
That
it's
a
failure
to
turn
property
into
capital,
so
in
our
world
we're
familiar
with
complex
networks
of
of
abstractions,
of
property,
arranging
composition
of
cooperative
arrangement.
So
we
have
the
concept
of,
let's
say,
owning
a
house,
but
then
we
have
the
concept
of
mortgaging
a
house
well
mortgaging
what
mortgaging
house
creates
this
new
valuable
arrangement?
But
then,
once
you've
mortgaged
the
house,
you
don't
own
the
house.
How
is
it
that
you
can
sell
the
house
if
you
don't
own
the
house?
A
What
you
do
is
you
sell
your
position
in
the
mortgage
contract
that
the
position
in
the
mortgage
contract
itself
becomes
a
new
abstract
form,
a
property
you
can
think
of
it
as
a
derived
right
where
the
house
itself
is
the
base
right
and
the
example
that
Hernando
DeSoto
gives
in
mystery
of
capital
is
the
inability
to
turn
ownership
of
a
house.
What
is
genuinely
from
an
economics
perspective,
ownership
of
the
house,
but
what
but
ownership
that
is
not
legally
recognized
by
the
external
world
legal
systems.
A
It's
recognized
by
the
systems
of
norms
in
the
local
community
that
one
that
particular
person
is
recognised,
owning
the
house
within
the
local
community.
They
can
sell
the
house
and
new
owners
recognize
as
owning
the
house,
but
they
can't
take
that
internal
recognition.
It
doesn't
fit
the
vocabulary
of
rights
that
these
other
external
built
up
arrangements
of
cooperation
understand.
A
A
So
in
computer
science
we
have
this
notion
of
higher
order
composition,
then,
for
each
form
of
higher
order
composition,
it
depends
on
some
ability
to
reify
and
those
abilities.
Each
time
you
have
an
ability
to
reify
there's
some
case
at
which
it
runs
out
of
steam
and
you
no
longer
have
an
ability
to
reify
within
that
system,
and
now
you
you,
the
that
failure
to
reify
should
provoke
you
to
build
a
new
higher
order
system
that
has
new
rules
of
reification
so
that
you
can
now
bring
this
higher
composition
into
that
new
realm.
A
So
in
the
world
of
functional
programming
languages,
where
you
have
pure
functions,
the
really
cool
thing
about
functional
programming
languages
is
functions,
operate
on
values
of
some
sort
and
will
compute
a
new
value
given
input
values,
but
a
function
itself
is
a
valent.
Is
the
kind
of
value
that
you
can
apply
functions
to
and
you
can
write
many
functions
like
a
like:
a
function,
composing
function
which
are
generic
that
will
take
any
function
as
input.
A
So
the
kind
of
thing
they
are
as
a
means
to
manipulate
values,
the
kind
of
thing
that
they
that
they
manipulate,
which
is
the
values
that
you
can
feed
into
the
function,
is
also
the
kind
of
thing
that
they
are
so.
Therefore
they
are
the
kind
of
thing
that
they
manipulate
and
therefore
you
can
compose
them
into
these
great
networks
of
functions
operating
on
each
other
and
eventually
on
base
values
and
create
the
richness
that
we
associate
with
with
with
functional
programming.
However,
functional
programming
is
specifically
mathematical
like
functions
with
no
side-effects.
A
The
world
has
stateful
concepts
like
a
bank
balance,
and
you
can't
take
a
mutable
bank
balance
and
reify
it
as
an
object
as
a
thing.
That
is
the
kind
of
thing
that
plays
within
the
world
of
higher
order
composition
of
the
functions
you
can
write
patterns
of
functions.
You
can
engage
in
these
other
patterns
with
monads
and
state
passing,
and
all
that
that
end
up
creating
a
new
level
of
abstraction,
but
you
can't
simply
apply
a
function
to
a
stateful
object
and
have
it
be
the
same?
A
Stateful
object
after
a
change
in
state,
so
instead
we
have
hi.
We
have
object-oriented
programming,
which
has
this
higher-order
nature
with
regard
to
stateful
things
that
you
can
take
a
mutable
object
store
it
in
a
table.
While
it's
in
the
table,
it
might
change
state
and
then
later
you
can
pull
it
out
of
the
table
and
it's
the
same
object
in
the
new
state.
A
That's
an
example
of
a
kind
of
composition,
a
kind
of
higher-order
composition
to
create
cooperative
arrangements
of
computation
that
you
simply
can't
do
in
a
direct
manner
in
functional
programming
and
when
you
build
up
patterns
that
do
that
you're
creating,
for
example,
a
new
object
layer
of
abstraction.
That's
really
distinct
from
the
functions.
A
A
A
So
therefore,
so
in
the
same
way
that
you
can
create
patterns
of
functions
that
give
rise
to
this
new
level
of
abstraction
of
objects,
we
can
create
patterns
of
objects
that
give
rise
to
a
new
level
of
abstraction
of
electronic
rights,
and
that's
what
we're
doing,
but
we're
not
just
trying
to
reify
electronic
rights,
we're
trying
to
do
it
in
a
higher-order
manner,
so
that
contracts
manipulate
rights,
but
a
contract
that
unfolds
over
time
like
a
mortgage,
any
contract
that
unfolds
over
time.
The
continued
participation
in
the
contract
is
a
derivative
value.
A
It
is
a
valuable
role.
It's
a
valuable
position
to
be
in,
and
we
want
that
valuable
role
to
be
a
valuable
tradable
right
and
to
consent
to
conceive
of
the
concept
of
rights
as
a
generic
vessel,
so
that
a
very
great
variety
of
kinds
of
rights
can
be
fit
into
that
vessel,
where
the
vessel
has
to
be
broad
enough
to
fit
many
things
into
it,
but
has
to
be
strong
enough
such
that
you
can
write
a
very
wide
range
of
market
institutions
of
kinds
of
contracts,
exchange
options,
various
forms
of
derivatives,
auctions,
etc,
etc.
A
We
found
that
we
could
right
these
things
in
a
generically
parameterize
away
in
a
way
that
was
parametrically
polymorphic
over
writes
in
very
very
much
in
a
way
that
is
very
much
analogous
to
what
we've
seen
before.
So
what
we're
trying
to
achieve
is
by
enabling
this
higher-order
composition
of
rights
and
contracts.
A
This
is
much
of
the
richness
of
the
real
world
of
the
thousands
of
years
of
evolution
of
market
institutions.
It's
that
those
deep
networks
of
contracts,
interacting
with
other
contracts
of
grievance
and
arrangements,
interacting
with
other
agreements
of
arrangements,
that
is
the
source
of
the
richness
of
the
world
of
the
market.
A
Without
this
hire
or
composition,
we're
not
going
to
reproduce
that
richness,
where
we
have
had
higher
order,
composition,
functions
and
objects.
We
have
seen
in
the
computer
world
a
richness
of
composition
where
we
have
not
seen
higher
a
composition
in
the
existing
world
of
blockchain
and
smart
contracts.
We
have
not
seen
deep
networks
of
cooperation.
A
However,
with
proper
humbleness,
we
should
understand
that
we're
probably
taking
a
step.
That
is
also
at
some
point,
going
to
run
into
a
reification
failure
it's
early
days
yet
so
we
don't
yet
have
a
painfull
reification
failure
to
talk
about,
but
we
should
expect
that
eventually
the
process
repeats
again,
there
is
a
reification
failure
and
there
will
be
a
need
to
create
a
pattern
at
this
level
that
can
create
yet
another
level
of
abstraction
to.
A
Provide
orientation
about
what
we're
doing
I'm
just
going
to
show
the
the
architect
architecture
of
gorrik
is
building,
but
we're
in
this
talk
only
concentrating
on
the
upper
layers
of
it.
So,
just
very
briefly,
each
for
each
rectangle
here
each
purple,
rectangle,
is
an
individual
machine.
Each
stack
is
a
logical
machine.
The
stack
on
left
is
a
public
blockchain.
It's
a
logical
machine.
A
A
So
our
object
capability
layer
is
a
secure
form
of
object-oriented
programming,
where
the
the
object
reference,
the
the
pointer
to
an
object,
is
a
is
a
write
and
message
passing
as
a
form
of
rights
transfer
and
we're
building
this
to
again
span
over
all
of
those
platforms
and
I'll.
Just
briefly
mention
why
that
that
form
of
spanning
is
so
powerful.
One
of
the
things
that
we're
used
to
with
the
web
is
that
the
web
is
mostly
a
public
system.
However,
companies
have
prepared
internal
web
sites
behind
the
firewall
that
contains
information.
A
However,
this
is
a
world
of
objects.
It
has
exactly
the
reification
failure.
I
was
just
mentioning
it's
not
able
we're
not
able
to
reify
a
tradable
right
directly
as
an
object,
so
we
build
patterns
of
objects
that
create
this
new
level
of
abstraction,
which
we
call
the
new
rights
and
smart
contracts,
and
we
there's
this
duality
here.
It's
exactly
the
duality
that
I
mentioned,
for
example,
with
selling
the
mortgage.
A
Glory',
each
protocol
builds
each
level
of
abstraction
out
of
the
previous
level
of
abstraction.
We
have
something
called
that
TP,
which
were
reconciling
with
the
ibc
system
from
cosmos
that
builds
the
that
level
of
abstraction
out
of
the
machine
level
of
abstraction
cap
DP.
That
builds
the
object
level
of
abstraction
out
of
the
that
level
of
abstraction.
Neither
of
those
are
relevant
to
the
talk.
A
So
an
object
reference
in
a
memory
safe
object,
programming
language
is
already
a
form
of
right.
Even
before
you
go
from
there
to
object
capabilities.
If
the
object
Bob
does
not
have
a
reference
to
object.
Carol
than
in
any
memory.
Safe
object,
a
programming
language
object.
Bob
simply
cannot
invoke
like
Carol.
She
cannot
make
use
of
carol
public
api.
He
cannot
be
provoked,
whatever
behavior
would
be
provoked
by
invoking
Carol.
A
However,
if
Alice,
who
has
a
reference
to
both
Bob
and
Carol,
invokes
Bob
passing
Carol
as
an
argument
that
is
both
Alice
exercising
her
right
to
invoke
Bob
granted
by
her
reference
to
Bob,
as
well
as
Alice
authorizing
Bob,
to
invoke
Carol
by
providing
the
reference,
and
now
the
Bob
receives
the
reference
he
can
invoke
a
Carol
so
to
get
from
objects
to
object
capabilities.
We
impose
the
constraint
that
these
references
between
objects
are
the
only
carriers
of
causality,
there's
no
other
form
of
causality
outside
the
system.
A
This
makes
the
reference
graph
from
the
programming
language
literature
identical
to
the
access
graph
from
the
access
control
literature,
so
that
the
richness
that
object
programming
already
gives
us
at
manipulating
the
reference
graph.
We
leverage
that
intuitively
as
an
as
a
direct
extension
of
object,
intuitions
for
manipulating
the
access
graph
for
manipulating
security
relationships,
and
the
result
is
that
we
can
express
what
would
normally
be
thought
of
as
as
complex
security
relationships
very
straightforwardly
with
simple
object
code.
That's
easy
to
explain.
A
So,
on
the
Left
we
have
our
object
layer
on
the
right.
We
have
Alice
paying
Bob
in
some
amount
of
money
as
an
example
of
the
kind
of
key
right
that
we
want
to
support.
Let's
take:
let's
use
the
contrast
between
objects
and
money
to
explore
the
differences
between
these
layers
of
abstraction,
so
objects
are
shared
once
Alice
gives
Bob
access
to
Carol.
There's
still
this
line
on
the
left.
The
diagonal
line
by
which
Alice
still
has
access
to
Carol
and
Alice
might
drop.
A
A
Objects
are
opaque
when
Bob
receives
this
reference
to
Carol.
All
Bob
knows
is
he's
received
a
reference
to
some
object
that
somebody
who
could
invoke
him
decided
to
give
him
whereas
Bob
in
order
to
consider
himself
to
be
paid.
Nice
needs
not
just
to
have
received
the
money.
He
needs
to
know
that
he's
received
the
money,
and
he
has
needs
to
note
that
he's
received
what
money
to
know
that
he's
received.
A
Objects
are
specific,
Bob
receives
exactly
Carol
itself,
that
particular
object.
Money
is
fungible,
Bob
doesn't
care
what
dollar
bills
he's
received.
He
just
cares
about
the
total
quantity
he's
left
with
at
the
end
of
the
day,
so
I'm
drawing
this
contrast,
not
to
say
that
objects
are
the
left
column
and
I
rights
are
the
right
column.
Objects
are
indeed
the
left
column.
A
That's
accurate,
but
bayi,
writes
I
include
all
of
these
variations,
all
these
degrees
of
variability
that
this
contrast
has
shown
us
four
of
the
dimensions
by
which
rights
can
be
different
from
each
other
and
by
II
rights.
We
want
to
include
all
of
the
variations
and
combinations
that
the
contrast
between
the
two
has
has
shown
us
as
a
world
to
explore
and
build.
A
So
fortunately,
the
patterns
you
need
to
express
in
object
to
build
ear.
I'ts
are
straightforward.
This
is
the
code
needed
to
build
the
money
with
the
attributes.
I
just
showed
out
of
objects
with
the
attributes.
I
just
show
so
over.
Here
we
have
an
outer
function
called
make
mint
and
each
time
we
invoke
make
mint.
It
makes
an
issuer
object
over
here.
A
ledger
object
and
a
mint
object,
and
it
creates
this
layer
in
which
those
three
objects
are
in
bed
with
each
other.
They
know
each
other.
A
A
A
So
we
consider
this
to
be
alice,
has
a
right
to
200
units
of
you
know.
Let's
call
it
gold
coins
instead
of
dollars
that
Alice
has
a
right
to
to
a
hundred
of
them
in
Bob,
has
a
right
to
200,
but
notice
that
the
rights
themselves
do
not
appear
in
the
diagram
and
the
rights
themselves
do
not
appear
in
the
code.
They
are
not
objects
that
you
can
store
and
retrieve
from
other
generic
objects.
A
So
what
Alice
does
first
is
she
sends
the
withdraw
method
to
the
purse
and
with
the
withdraw
method
does
is
it
makes
a
new
purse
so
we're
gonna,
so
that
was
the
the
Alice's
main
purse,
creates
a
new
payment
purse
and
then
consults
the
ledger
and
moves
ten
units
from
the
main
person.
The
payment
purse,
then
Alice
sends
the
payment
to
Bob,
and
but
with
this
buy
method,
this
buy
message
where
the
buy
message
says
contains
the
payment
and
also
a
description
of
what
Alice
wants
to
buy.
A
And
now
we
have
an
interesting
dilemma:
Alice
have
you.
You
might
think
that
Alice
has
reified
the
payment
in
the
payment
purse.
We
even
called
the
object
pane.
So
as
far
as
Alice
is
concerned.
At
this
point,
she's
paid
Bob,
but
we
colored
that
reference
arrow
red,
because
Bob
has
no
way
of
knowing
that
Alice
has
dropped.
It
Alice
might
still
have
access
to
the
painted
purse.
But
that's
not
our
only
problem.
A
There's
also
Alice
knows
that
she
sent
a
purse
whose
purpose
was
to
pay
Bob,
but
Bob
doesn't
know
this.
Yet
he's
just
received
some
object
from
Alice.
He
doesn't
know
what
it
is,
but
objects
are
exercisable.
You
can
invoke
them,
so
we
can
use
the
behavior
of
the
objects
when
invoked
to
bring
about
the
change
of
state
that
represents
at
our
higher
level
of
abstraction
that
the
the
motion
of
Rights
so
Bob,
so
going
back
to
our
code.
A
Bob
does
this
by
sending
a
deposit
message
to
his
main
purse,
saying
deposit
into
yourself
ten
units
from
the
argument
purse.
These
purses
consult,
ledger
change,
the
Ledger's
representation
of
that
and
at
no
time
has
Bob
revoked
Alice's
access
to
the
payment.
Allit
Bob
cannot
revoke
Alice's
access
to
the
payment
object,
but
it
doesn't
matter
because
now
the
payment
object
is
associated
with
zero
units.
Bob
has
revoked
the
usefulness
of
the
payments
object.
Alice
still
has
access
to
it,
but
it
does
her.
No
good.
A
The
code
that
I
showed
you
created,
ear
I'ts
out
of
objects,
but
it
was
not.
It
did
not
yet
fit
into
our
framework
for
creating
higher-order
composition
of
contracts
in
a
smooth
way.
So
I
want
to
be
realistic
about
how
much
code
it
takes
to
do
this
for
real
and
that's
the
code
on
the
right
which
I
will
not
go
through,
but
I
do
want
to
emphasize
something
about
the
previous
piece
of
code,
this
code
and
every
piece
of
how
you're
about
to
see
in
this
talk,
which
is
well.
A
Surely,
if
they're,
if
they're
doing
this
cryptographically,
the
code
must
be
expressing
cryptographic
concepts
and
the
answer
is
no,
that
it
isn't
the
the
answer.
Is
that
that's
one
of
the
things
that
we're
buying
with
our
layer
separation
is
designing
new
cryptographic
protocols,
designing
new
arrangements
of
cryptographic.
Primitives
is
bloody,
hard
and
experts
get
it
wrong
all
the
time,
and
if
every
time
we
need
a
new
complex
cooperative
arrangement,
we
have
to
do
it
by
figuring
out
a
new
arrangement
of
cryptographic.
Primitives
our
new
economy
is
sunk,
we're
not
going
to
get
there
that
way.
A
Instead,
our
approach
is
to
invest
that
effort
once
in
the
cryptographic
under
this
isn't.
This
is
actually
the
a
first
approximation,
it's
not
quite
true,
but
it's
it's
sufficiently
true
that
it's
the
main
truth
of
programming
in
the
system,
which
is
we
we
invest
the
effort
in
building
the
cryptographic
protocols
once
the
very
hard
effort
to
create
the
system
of
distributed.
Secure
objects
such
that
once
we've
got
the
power
of
distributed,
secure,
object
capabilities.
We
can
now
take
a
great
variety
of
cooperative
arrangements
and
express
them
simply
in
terms
of
objects
and
object.
A
So
we
use
we'll
use
that
as
one
visual
language,
where
you
still
have
issuers
and
persons,
but
the
e
rights
move
between
them
will
also
use
the
the
visual
language
where
the
e
write
is
just
carried
in
a
message
and
in
this
case
Alice
buying
a
ticket
from
Bob
through
the
code
on
the
right
once
Alice
receives
the
payment
alice
is
a
bob,
is
able
I'm
sorry
when
Bob
receives
the
payment.
Bob
is
able
to
know
that
he's
been
paid
before
releasing
the
concert
ticket.
However,
this
protects
Alice
from
Bob.
A
A
We
need
to
go
from
this
picture
to
a
picture
that
includes
smart
contracts,
including
a
smart
contract
that
brings
about
an
exchange
as
an
all-or-nothing
exchange
between
two
parties
that
either
both
al
that
that
Alice
knows
she
won't
lose
her
money
unless
she
gets
a
ticket.
Bob
knows
he
won't
lose
the
ticket
unless
he
gets
the
money.
A
A
A
So
this
is
the
thing
that
Alice
and
Bob
and
a
million
other
contracting
parties
would
have
common
knowledge
of
a
particular
contract
host
and
what
the
contract
house
does
is
it
accepts
code
from
Alice
and
Bob
and
whoever
else
knows
the
contract
host
and
the
highlighted
line
here
is
where
the
contract
host
starts
a
contract.
So
let's
say
that
that
Bob
submits
a
escrow
exchange
contract.
A
So
now
the
escrow
exchange
contract
has
been
set
in
motion
by
the
contract
host
and
what
the
escrow
exchange
contract
does
is.
It
creates
two
roles
for
participation
in
the
escrow
exchange,
and
then
the
contract
host
takes
that
and
turns
them
into
seats
that
Alice
and
Bob
can
sit
in,
which
is
their
ability
to
continue
to
participate
in
the
contract,
and
now
that
Alice
and
Bob
can
participate
through
these
seats,
they
can
send
Alice
can
send
in
the
money
that
she
would
like
to
use
to
buy.
A
The
ticket
Bob
can
send
in
to
take
it
that
he
would
like
to
offer
to
get
the
money
in
exchange
and
the
escrow
exchange
agent
will
just
go
to
the
issuer's
and
obtain
both
of
those
rights
and
verify
that
it
has
obtained
the
rights
that
it
has
obtained
from
Alice
the
rights
that
Bob
demands,
and
that
has
obtained
from
Bob
the
rights
that
Alice
demands
and
once
that
it
once
it
has
verified
that
it
can
release
the
the
the
coin
into
Bob's
main
coin
purse.
It
can
release
the
ticket
into
Alice's
main
ticket
purse.
A
So
the
s
and
escrow
exchange
is
fairly
immediate.
Much
more
interesting
example
is
the
covered
call
option,
which
is:
let's
say
that
the
reason
that
Bob
wants
to
sell
the
ticket
is
he's
bought
a
$500
ticket
to
a
concert
that
he
wants
to
go
to,
but
now
he
finds
that
oops.
He
has
a
conflict,
he's
gonna
be
out
of
town.
He
wants
to
sell
it
to
Alice,
but
Alice
doesn't
know
if
she,
if
she
really
wants
to
attend,
she
needs
to
make
some
other
plans
so
she'd
like
to
reserve
the
ticket.
A
So
she
says:
okay
Bob.
If
I
give
you
ten
dollars,
can
you
just
hold
on
to
the
ticket
reserve
it
for
me
for
a
few
days,
so
I
can
make
some
other
dependent
plans,
so
so
Bob's
reservation.
If
Bob
agrees
to
reserve
it,
that's
a
covered
call
option.
It's
very
much
like
the
cover
call
options.
The
things
called
covered
call
options
which
are
derivative
instruments
in
the
financial
industry
just
logically
the
same
relationship
and
the
covered
call
option.
Why?
A
If
it's
more
interesting
than
in
the
escrow
exchange,
it's
more
complicated,
why
is
it
so
much
less
code?
It's
because
this
piece
of
code
actually
wraps
the
escrow
exchange
code.
It
uses
the
escrow
exchange
and
front-ends
it
in
order
to
create
the
differences
between
a
covered
call
and
an
escrow
exchange.
So
so,
how
does
a
cover
call
differ
from
an
escrow
exchange?
Well,
first
of
all,
the
ticket
is
pre
escrow.
Until
the
the
contact
LLL
via
the
cover
call
option,
has
the
ticket
safely
squirreled
away,
where
only
it
can
transfer
it.
A
A
Also
with
the
escrow
exchange
either
party
can
at
will
cancel
the
arrangement
with
the
contract
host
bob
has
given
up
the
right
to
cancel.
The
cancellation
is
instead
held
by
a
timer
created
by
the
contract
test
and
other
than
that,
it's
the
same,
and
it
uses
the
escrow
exchange
underneath
the
surface
it
delegates
all
the
hard
work
to
the
escrow
exchange,
and
the
result
is
that
now
alice
is
in
this
valuable
arrangement.
But
now
that
alice
has
this
reservation.
A
Let's
say:
Alice
finds
that
oops
she
does
need
to
travel
anyway
or
she
can't
make
use
of
it.
But
fred
is,
she
knows
fred
happens
to
be
interested.
Maybe
she'd
like
to
sell
the
position
in
the
reservation
to
fred,
so
this
is
higher
order
composition.
This
is
every
time
we
create
a
contract
that
unfolds
over
time.
We
have
created
a
derivative
value.
We've
created
a
situation
that
is
a
valuable
situation
to
be
in
and
to
bring
about
higher
or
a
composition
of
rights
and
contracts.
We
need
those
derivative
values
to
themselves
be
derivative
rights.
A
This
is
is
basically
functioning
as
the
seat,
where
Alice
has
the
ability
to
participate,
but
for
the
escrow
exchange
option
down
here,
it's
acting
as
an
issuer,
so
so
so
to
this
contract.
The
issuers
are
gold
coins
and
tickets
to
this
contract.
The
issuers
are
the
seat
issuer
and
the
silver
coin
issuer
over
there,
where
Bob
would
buy
the
covered
call
option
for
Alice
for
these
silver
coins.
A
So
this
these
seats
has
derived
rights,
as
derived
tradable
rights.
Show
us
demonstrate
that
this
taxonomy
we've
opened
up
is
a
genuine
taxonomy.
Is
it
really
does
open
up
or
reach
a
rich
space
of
kinds
of
rights?
This
seat?
This
ability
to
continue
play
in
the
first
contract
like
money,
is
an
exclusive
right.
A
The
purpose
of
obtaining
the
seat
is
the
possibility
of
exercising
it
of
making
use
of
it
of
bringing
about
the
behavior
of
the
upper
contract.
That's,
what's
that's
the
right
being
created
and
lower
contract
is
the
ability
to
bring
about
behavior
in
the
upper
contract.
So
therefore
the
that
that
right
is
exercisable.
The
way
an
object
is
exercisable
in
order
for
Fred
to
buy
it,
it
needs
to
be
available,
and
this
is
actually
where
the
interesting
problems
are.
The
interesting
design
issues
is
the
upper
right.
A
The
upper
right,
the
derivative
right,
is
created
by
an
arbitrary
program.
That
is
the
smart
contract
that
has
been
that
you
know
has
to
be
designed
to
fit
into
the
framework,
but
it's
some
arbitrary
program
that
has
been
designed
to
fit
in
the
framework.
Nevertheless,
fred
has
to
be
able
to
describe
what
role
it
is
that
he's
trying
to
acquire
what
what
the
nature
is
of
what
he's
trying
to
be
able
to
continue
play
in.
A
A
Right
and
the
other
thing
is
that
the
fungible
tokens
and
the
non
fungible
tokens
are
like
completely
different
from
each
other.
Nobody
writes
contrary.
You
know
over
here.
If
I
write
an
auction,
you
know
some
some
like
a
second
price,
sealed
bid,
auction
or
English
auction
or
Dutch
auction
or
continuous
double
auction.
A
So
they
can
now
be
so
that
now
that
they're
heavily
vetted
and
well
understood
they
can
be
applied
with
confidence.
And
then
these
simple
wrappers,
the
simple
compositions,
can
then
be
simple
and
simple
to
understand.
One
of
the
key
things
about
object
capabilities,
as
opposed
to
other
security
architectures,
is
to
support
compositional
reasoning
about
correctness.
A
Even
in
regards
to
matters
when
there
are
multiple
interests
and
rights
at
stake,
this
is
something
where
the
the
main
security
paradigms:
identity
based
access,
control,
which
etherium
and
and
the
conventional
smart
contracting
world
we
see
today
is
mostly
trafficking
in.
We
know
that
it
does
not
support
compositional
reasoning
about
correctness
with
regard
to
section
security
matters,
so
high,
reuse,
plus
compositional
reasoning
about
correctness,
enables
simple
compositions
of
complex
but
highly
reusable
components
to
be
done
with
confidence.
A
A
A
A
In
a
world
where
there
are
millions
of
different
designed
kinds
of
Rights
lots
and
lots
of
different
contracts,
creating
lots
and
lots
of
derivative
rights,
how
do
you
expect
people
or
the
program's
people
right
to
be
able
to
navigate
that
and
understand
what
right
they
want
to
to
trade
in
and
what
that
right
means?
Kate
am
I
getting
that:
okay,
good,
so
reducing
it
to
a
previously
unsolved
problem.
A
Conventional
software
engineering
is
able
to
build
up
tremendous
rich
world
of
software
that
has
really
created
the
modern
world
without
solving
that
problem,
either
with
regard
to
objects.
But
what
we
found
is
that
we
that
we
can
go
a
great
distance
without
solving
the
problem.
There's
lots
and
lots
of
different
interface
types
and
lots
of
different
api's
that
essentially
solve
the
same
problem
in
ways
that
are
not
interoperable
and
we've
got.
A
It
means
that
the
world
is
tolerant
of
having
a
great
diversity
that
the
richness
of
a
great
diversity
gives
us
a
richness
of
experimentation,
a
diversity
of
ways
to
provide
functionality,
and
it
does
it
at
some
cost
at
making
discovery
harder.
And
then
we
build
up
these
other
institutions
to
try
to
ease
the
discovery
process
without
reducing
the
variation.
A
Yeah
so
so
object,
I'm.
Sorry,
the
fact
that
these
rights
are
exercisable
does
that
give
us
an
ability
to
I'm
going
to
rephrase,
but
tell
me
if
I
got
it
right.
Does
that
give
us
an
ability
to
represent
within
the
system
our
rights
to
manipulate
things
outside
the
system
into
physical
world?
And
the
answer
is
yes,
and
this
very
much
builds
on
the
fact
that
the
answer
with
objects
is
already.
Yes,
we
use
our
computer
systems
all
the
time
to
manipulate
things
in
the
world.
A
Let's
just
take
the
example
of
a
printer
in
a
given
office,
so
we
might
take
the
printer
driver
and
abstract
it
off
up
into
a
set
of
api's.
That
objects
can
invoke
for
for
commanding
the
printer.
But
now
you
can
wrap
that
right
in
an
ER,
TP
interface,
and
now
you
can
manage
the
allocation
of
that
right.
Let's
say
within
this
is
a
great
example
of
use
of
it
within
an
organization
rather
than
a
public
blockchain.
A
A
Several
of
the
founders
of
the
goreck
had
earlier
founded
a
well
I.
Don't
need
to
go
into
that!
The
answer
is
yes,
that
that
that
it's
very
straightforward
to
create
that
that
anytime,
you
have
software
able
to
cause
action
in
the
world.
You
can
abstract
a
wrapper
around
that
which
is
an
exercisable
right
to
provoke
that
software
to
affect
the
world
yeah.
A
A
Company
adopting
it
to
make
the
biggest
difference
right
and
and
be
all
of
them
will
get
different
incomparable
benefits
from
adopting
this,
and
we
saw
him
in
bot
stock.
You
know
the
ability
to
reduce
the
cost
of
trust
across
trading
resources
across
trading
stocks
across
communication
across
supply
chain
across
transport.