Vote contract

Purpose

The Vote contract creates ballots, establishes who may vote, records votes and produces verifiable results. The same model serves a street deciding on a playground, a school class choosing a trip, a gaming community voting on features, shareholders voting on governance, or an association electing officers. These cases differ in who is eligible, how eligibility is established and how much a vote may reveal; the ballot's policy selects the eligibility, privacy and counting rules for each.

The protocol records decisions. It does not execute them. Whether a result is binding, and how it is acted upon, is decided outside the protocol by the organisation that ran the ballot.

Participants

• Organisers define the ballot by publishing its policy.
• Eligibility authorities, named in the policy, confirm who may vote and with what weight: a teacher confirms a class, an association its members, a company its holders of record. The authority is accountable for the electorate; the protocol records what it confirmed and does not verify real-world entitlement itself.
• Voters are the members of the electorate. Each entitlement binds one voting key to one voter and, where the policy provides, to a weight.
• Accountable Nodes provide identity attestations where a policy requires assurance beyond the authority's own confirmation, and hold the key of a sealed ballot until it closes.
• Verifiers are anyone. They check the recorded policy, electorate, votes and result and recompute the count.
• Applications such as Ballotee provide the user interface: ballot design, invitations, vote preparation and result presentation. The protocol defines what they submit and what the chain guarantees about it.

The ballot policy

A policy fixes the question and its options, the voting method, the eligibility requirements and the named authority, weighting, opening and closing times, quorum, approval thresholds, tie treatment, whether abstention is recorded, whether a voter may replace a submitted vote before close, the privacy profile, the treatment of a ballot that cannot be counted, and who may cancel the ballot and until when.

Every rule that affects voting or counting is fixed before voting opens. A ballot whose rules must change is cancelled and a new one created. The electorate is complete and confirmed before voting opens; a vote from a key not in the electorate is rejected.

What the protocol guarantees

• Only confirmed members of the electorate may vote.
• Each entitlement contributes at most one counted vote, weighted no more than its permitted weight.
• An accepted vote cannot be silently altered or removed. Where replacement is permitted, only the applicable vote counts and the replaced vote stays in the history.
• Counting follows the published policy and is deterministic: anyone with the policy, the electorate and the accepted votes obtains the same result.
• A recorded outcome is final. A disputed ballot is addressed by conducting a new one, never by reversing the result.
• Results remain verifiable from the on-chain record alone.

Public and sealed ballots

In a public ballot each vote is recorded in clear. Individual choices are visible to anyone, the running count can be observed while voting is in progress, and verification is by reading the record.

In a sealed ballot each vote is encrypted to the ballot's key, which the assigned Accountable Nodes hold until close and then disclose on chain. Choices and partial counts stay hidden from the public while voting is in progress, and the count is performed once the key is disclosed. This is delayed visibility, not lasting secrecy: after disclosure every choice is permanently linked to the voting key that cast it, and the eligibility authority knows the persons behind the keys. In both profiles the fact that a key has voted is public, and every voter can verify that their own vote was recorded as submitted.

Outcomes

A ballot ends in exactly one recorded outcome. A finalised result states the winning option or options, or that the quorum or threshold was not met. A ballot that could not be counted is recorded as such when the key of a sealed ballot was not disclosed within the recovery time, or the ballot was cancelled under its rule; it has no result. Votes that cannot be counted individually, such as an encrypted vote that does not decrypt to a valid choice, are recorded as rejected at counting and excluded from the tally under rules fixed by the protocol.

Out of scope in this version

• Lasting ballot secrecy by cryptographic means such as mixing or blind credentials; version 1 offers delayed visibility only.
• Coercion resistance and vote-buying countermeasures beyond what vote replacement provides.
• Delegation and proxy voting, voter self-registration and multi-question ballots.
• National elections, which need a dedicated profile for universal identity assurance, anonymity and scale before support is claimed.
• Legal recognition of results, electoral disputes and enforcement of decisions.