Aggeus Market is a protocol for creating prediction markets on bitcoin. The protocol needs an oracle, a set of one or more market makers, a set of one or more buyers, and a coordinator. Notably, the coordinator never has custody of anyone’s money.
Suppose a market maker named Mary wants to win money by correctly predicting the outcome of a political contest where Reginald the Republican is running against Dave the Democrat. The market is called "Will Reginald win the Reginald vs Dave election?" and its participants have Yes contracts and No contracts available for sale, each of which is denominated at 10k sats. (Throughout this document, I call such contracts Shares.) Mary thinks Reginald only has a 20% chance of winning, so she decides to create a 10k sat "Yes share" and offer it for sale for 2k sats, such that if someone pays her 2k sats and the Oracle later reveals a secret Y (meaning “Reginald won”), the buyer of her share will get 10k sats -- Mary gets to keep the winner's 2k sats, however. If Reginald loses, the Oracle may reveal a secret N, meaning "Reginald did not win," in which case Mary will get back her 10k sats and keep the loser's 2k sats.
Mary begins by planning to do the following thing: she will deposit 10k sats into a smart contract with two spending paths: the first is a 2 of 2 multisig between herself and a coordinator whom I shall call Charlie; the second allows Mary to unilaterally withdraw all 10k sats from that address 1 day after the market is expected to resolve. Before depositing the 10k sats, she creates a PSBT that consumes the multisig as an input and has two outputs: the first puts all 10k sats in a smart contract to be described shortly, and the second gives 2k sats to Mary (these 2k sats must come from an input supplied by Charlie). The smart contract allows Mary to withdraw all 10k sats if the Oracle reveals N (i.e. Reginald did not win, and Mary predicted correctly), otherwise Charlie can take all 10k sats if the Oracle reveals Y. Charlie does not yet provide an input to the PSBT, so it is not yet valid. Mary, however, signs the PSBT with sighash_all | anyone_can_pay, and shares her signature with Charlie. Now Mary can go offline, after broadcasting the funding tx that funds the multisig.
Suppose a Yes buyer named Yves signals that he wants to buy Mary’s Yes share. The cost is 2k sats, so he sets up a new contract with Charlie, to be funded with 10k sats momentarily by Charlie, with the property that Yves can withdraw all 10k sats from the contract if and only if the Oracle reveals Y and if Yves learns a preimage currently known only to Charlie. Charlie funds this contract with 10k sats and then waits for Yves to pay him 2k sats via lightning. If Yves does so, Yves learns the preimage; note that Yves should only pay this LN invoice after the funding tx for the new contract confirms. Once the LN invoice is paid, Charlie adds an input to Mary’s PSBT, and broadcasts the resulting transaction, resulting in 10k sats going into the smart contract, and 2k sats going directly to Mary.
Yves may put his share up for sale again for a new price, and I will explain how he may do that shortly, but for now, let us suppose he did not put it up for sale during the remaining time of the election cycle, he just kept it. If the Oracle reveals the secret Y on resolution day, Yves gets Y, and can immediately takes his money from his contract with Charlie. Everything is roughly fair: Yves gets 10k sats after paying 2k sats, for a gain of 8k sats; Mary put 10k sats in the original contract, and, since Y was revealed, she only gets to keep the 2k sats already sent to her by Charlie, whereas Charlie gets the 10k sats in his smart contract with her, meaning Mary in total gets a loss of 8k sats; Charlie apparently lost 10k sats in his contract with Yves, but not really because N was not revealed, which means he got 10k sats from his contract with Mary, and thus that money covers his apparent loss of 10k sats. (Somehow I also need to ensure he gets paid for his services. I can probably have him do this by charging a fee to everyone who wants to use his services.) The Oracle neither gained nor lost anything, as all he did was promise to reveal some data and then do so, and no one else was involved. Inputs: 10k from Mary; 2k from Yves; 2k from Charlie. Outputs: 2k for Mary; 10k for Yves; 2k for Charlie.
Now let us suppose Yves did not keep his share, but put it up for sale for 7k sats (if someone accepts this offer Yves will end by having paid 2k sats to Mary and earned 7k sats from the buyer, for a net gain of 5k sats, which probably means Reginald rose considerably in the polls). To put his share up for sale for 7k sats, Yves gives Charlie a sig that lets Charlie take 10k sats from the contract if Charlie pays 7k sats to Yves. Yves may now go offline. Suppose he does so, and while he is offline, a buyer, Yvonne, signals that she wants to buy the shares from Yves. She sets up a new contract with Charlie, to be funded with 10k sats momentarily by Charlie, with the property that Yvonne can withdraw all 10k sats from it if and only if the Oracle reveals Y and Yvonne learns a preimage currently known only to Charlie. Charlie funds this contract with 10k sats, and completes the PSBT from Yves if and only if Yvonne pays Charlie 7k sats via lightning, thus learning the preimage – and she only pays the LN invoice after the new contract confirms.
If the Oracle reveals the secret Y on resolution day, Yves gets Y but cannot do anything with it because the money in his contract is gone: after fulfilling the PSBT, Charlie broadcasted the resulting transaction, meaning Yves got his 7k sats, and the 10k sats in the contract went to Charlie. Yvonne also gets Y (as the Oracle revealed it), and she can do something with it: she can immediately take her money from her contract with Charlie. Everything is roughly fair: Yvonne gets 10k sats after paying 7k sats, for a gain of 3k sats; Yves got 7k sats after paying 2k sats to Mary, for a gain of 5k sats; Mary effectively paid 10k sats and received 2k sats from Yves, for a loss of 8k sats; Charlie apparently lost 10k sats in his contract with Yvonne, but not really because the 10k sats in Mary’s contract went to Charlie, so it’s a wash for him, except he probably earned money by charging fees to his users. The Oracle neither gained nor lost anything, as all he did was promise to reveal some data and then do so, and no one else was involved. Inputs: 10k from Mary; 2k from Yves; 7k from Yvonne; 2k + 7k = 9k from Charlie. Outputs: 2k for Mary; 7k for Yves; 10k for Yvonne; 2k + 7k = 9k for Charlie.
What if the Oracle revealed N instead of Y? In that case, Yves paid 2k sats for Mary's share, gained 0 from it, and got 7k sats from Yvonne (through Charlie), so he ends up with a net gain of 5k sats. His payment of 2k sats effectively went to Mary through Charlie, in the following manner: using the now-revealed N, Mary takes the 10k sats from her multisig with Charlie, and she also keeps the 2k he sent to her earlier; remember that the 10k in her contract came from her, as it was the money she put into the share, but she ended up with a net gain of 2k sats, all from Charlie’s payment. Yvonne paid Charlie 7k sats for Yves’ share; not having Y, she could not withdraw 10k sats from her contract, so that 10k sats went to Charlie, but it is no gain for him, as that 10k was his money, he put it there. The 7k sats that he gained from Yvonne effectively went to Yves, which is why Yves effectively gained 5k sats. The Oracle neither gained nor lost anything, as all he did was promise to reveal some data and then do so, and no one else was involved. Inputs: 10k from Mary; 2k from Yves; 7k from Yvonne; 2k + 7k = 9k from Charlie. Outputs: 7k for Yves; 12k for Mary; 0 for Yvonne; 2k + 7k = 9k for Charlie.
Yes and No shares can be created and traded all the way until the market resolves, with their prices fluctuating between 0 and 10k sats depending on how likely the market thinks each outcome is. When the market resolves, whichever secret the Oracle reveals, everyone who bought shares corresponding to that secret can withdraw 10k sats apiece from their multisigs with Charlie, who gets reimbursed via his contracts with the original market makers who created each share, because in those contracts, he gains the exact same amount of money that he lost to the winners. In the other multisigs, the ones belonging to the losers, Charlie gets to withdraw the 10k sats from their multisigs, and these sats reimburse Charlie, who loses the same amount in his contracts with the original market makers who created the winning shares. Charlie effectively takes both sides in every trade, so that it's always a wash for him, but he earns money by charging fees to each user for the use of his services, as he is the one who needs to stay online so that everyone else has a non-interactive trading experience.