~2 min
block time (target)
Built by an auditor, broken by one, until it held. The record — not a slogan — is the argument.
Every essential protection a sovereign ledger needs was implemented, then attacked relentlessly. Around a dozen real vulnerabilities were found and fixed in the reference implementation. The browser wallet then went through five rounds of independent adversarial audit — each finding closed and re-verified against the live network.
XSS surface eliminated; SHA-256 + network-domain signing; balance counted only from on-device membership proofs; two-node completeness & maturity cross-check; BigInt amounts; 600k-round PBKDF2; mandatory key backup; strict CSP.
A cross-side test proves byte-for-byte agreement on the domain, serialization, SHA-256 digest, compact signature, low-S handling and transaction id — run against the real node code and the real in-browser crypto library.
| suite | covers | result |
|---|---|---|
| accumulator | root parity · inclusion · exclusion (randomized sizes) | pass |
| wallet ↔ node parity | domain · serialization · digest · signature · txid | 9 / 9 |
| light client | header PoW chain · coin proof · non-membership | pass |
| consensus & reorg | most-work fork choice · reorg mempool reclaim · MTP | pass |
| double-spend / dup-input | within-block & cross-block spend attempts | rejected |
| fuzz / long-stress | malformed blocks & txs · sustained load | pass |
| guardian / vault | bounded recovery · limits · challenge resolution | pass |
Suites live in the reference repository as test_*.py / attack_*.py. Names, not adjectives.
The batch light endpoint rebuilds state once per tip and caches proofs per owner; the wallet verifies a full balance against two nodes in under a second on a warm cache.
Refutation-Matured Audit (RMA) explores letting off-chain agents point at a suspected invariant violation and having the chain resolve it deterministically. The note is deliberately honest: an internal red-team demolished an earlier draft's economic claims, and the paper retracts them in full — reporting what runs, what does not yet hold, and what stays open. Honesty about a negative result is the point.