How it worksv0.1
A mint issues signed notes and remembers one bit for each. Everything else follows from three rules:
A transfer moves value one layer on.
The last layer cannot move until the next rotation.
Every rotation drops the oldest layer.
A note is 149 signed bytes: version, issuer key, serial, amount, holder key and the issuer's signature. Its holder keeps it. The mint keeps one bit for it, 1 while it is live and 0 once it is spent.
The serial names the bit, so checking a note is one lookup and spending it clears one bit. A spent note's bit is already 0, so it cannot be spent twice.
The bits are split into layers, oldest first. A newly minted note lands in the second-to-last layer. A transfer spends its input and issues the new notes one layer further on. A note in the last layer is frozen until the next rotation.
Click any note in the diagram to follow it, and hover one to read it the way a holder's SDK would.
At every rotation the mint drops the oldest layer, wipes it, and reuses it as the new last layer under a fresh signing key. Notes still in the dropped layer die. Notes that were frozen can move again.
So one setting, the rotation period, sets both limits. With 4 layers rotated daily, a note moves at most once a day once it reaches the last layer, and a note left alone dies within 4 days. Three example settings:
| Use | Period | Layers | Idle tokens die after |
|---|---|---|---|
| Metered quota | 1 minute | 60 | about an hour |
| Agent credits | 1 hour | 168 | about a week |
| Reward points | 1 day | 30 | about a month |
A holder keeps a note alive by paying it to a fresh key of its own before its layer is dropped. The SDKs do this for you, each note at a random moment before the rotation.
A mint of four layers48 bits each
Four layers, oldest at the top. Click a note to transfer it, or use the buttons.
The mint sees every transfer's input die and its outputs appear, so it can follow each note's lineage, along with amounts and timing. It never learns who holds a note, and it cannot tell that two unrelated notes share an owner, as long as holders keep three rules. The SDKs keep them by default:
Spending two at once would tell the mint they had one owner, the way blockchain analysis links addresses.
So a burst does not read as one payment.
This is weaker than blind-signature schemes such as Chaum's, Cashu or GNU Taler, where the issuer cannot link a note to the one it replaced, and stronger than any account system. Blind signatures cannot work here, because the mint must choose each serial: the serial names the bit. README
Only a mint authority listed in the mint's policy can mint, by signing each request with a rising sequence number, so a copied request cannot mint twice. Holders can burn notes to take them out of circulation at once. The mint counts value minted, destroyed by rotations and burned, so outstanding supply can be audited at any time.
Each generation of notes is signed by its own key, certified by the mint's issuer key and erased when its layer is dropped. A leaked generation key forges notes for at most as many rotations as there are layers. Anyone with the issuer key can check a note offline against the published certificates.
Every change is written and flushed to a log before it is applied, and one flush covers a whole batch of transfers. Three servers can run as a cluster: each mint is a Raft group of the three, a transfer is answered once two of them hold it on disk, and if the leader fails another takes over within a few seconds. README
2 of 3 → answered