A Plain-Language Walk-Through
The goal is to let any device (even one that stays offline for long periods) create, move and verify private balances without ever leaking amounts or letting attackers forge money.
A tamper-proof genesis that every device can recreate and verify.
Each device updates its own balances epoch-by-epoch while offline.
Rules that let two devices meet, exchange proofs and instantly agree on honesty.
Instead of a one-time ceremony, the system uses a perpetual randomness beacon that runs continuously. Time is divided into equal-length epochs (like hours), and each epoch gets its own unpredictable random number from a public beacon (like the drand network).
Anyone who wants to issue or hold the cash can join at any time, not just at the beginning. Each new participant contributes their own randomness during a "contribution window" in each epoch:
This creates an infinite, self-healing randomness pipeline where new participants can join anytime, and every later state remains a hard-to-predict descendant of the very first seed. No one needs to trust any authority – the math itself provides the proof.
A balance is never stored as "42 coins". Instead the wallet stores a single curve point using aPedersen commitment:
Only the owner knows the value and blinding numbers, so outsiders see C as just a random point. This is called perfect hiding – no one can figure out the amount from the commitment.
Pedersen commitments have a special property: you can add them together mathematically while keeping the amounts hidden. This allows the system to verify that money isn't being created or destroyed without revealing any amounts.
Time is cut into equal-length slots (say, one hour). Every slot has a public random number beta that comes from the drand randomness beacon. An offline device cannot fetch drand, so it uses the beacon value that was stamped in the published seed file plus a simple, deterministic function of the slot number.
To roll its balance from slot i to slot i + 1 the device recomputes:
Note what that does:
So the commitment looks fresh each epoch, but any honest device that sees the full chain of points can check that every jump matches the public beta sequence – if any point is tampered with the chain breaks.
When two devices meet, each shows (a) its current commitment and (b) a link proof: a short Schnorr signature that proves "I know the same hidden amount in the current point and in the previous point". Chaining those proofs back to the genesis point convinces the peer that no slot was forged or skipped.
C_out = G * amount + H * r_outDelta = C_out - (G * amount)The magic of Pedersen commitments is that you can prove the transaction is valid (no money created/destroyed) without revealing the amounts. The receiver gets a new commitment that hides their balance, while the network can verify the mathematical relationships hold true.
The receiver (online or offline) checks:
C_sender_new = C_sender_old - Delta.If everything passes the receiver adds C_out to its own wallet, stamps the nullifier into its RocksDB and moves on.
Sooner or later every wallet will reconnect to an online node. At that point it broadcasts:
Full nodes run three cheap checks:
If any of those fail, the cheating wallet's last good commitment is frozen and future spends using its nullifiers are rejected. Honest offline wallets are unharmed.
Inside each block (or local log entry) the node collects all new commitments and nullifiers into a Merkle tree. The Merkle root becomes the block hash so devices that only care about their own notes can store just the path.
Validators run HotStuff-style BFT. Blocks form a Directed Acyclic Graph until a super-majority signs a quorum certificate; then the branch is final. The DAG structure never touches the math of commitments, so it can be upgraded without changing the money layer.
That is the entire protocol in plain words – no heavy algebra, no hidden trust, and every step maps directly to code you can write with curve25519-dalek, merlin, RocksDB and a drand HTTP client.
Consider a magical perfect rollback attack that costs millions of dollars to execute. An attacker with nation-state resources could theoretically:
The system provides absolute detection even against perfect rollback attacks:
Even offline clients can detect rollbacks by checking the epoch chain. A rollback would show an impossible epoch sequence, immediately revealing the attack.
Multiple parties in a transaction verify the same epoch state. Any discrepancy indicates a rollback attempt.
Even with unlimited potential fraud, the attack economics make it irrational:
The system ensures that even honest offline clients can detect perfect rollback attacks. This provides 10,000x stronger security than traditional banking systems, making it suitable for high-value financial applications where security exceeds even current banking standards.
Special thanks to the community members and selfless volunteers who contributed reviews, feedback, and technical insights to make this documentation possible.