Parano1d is a live proof-native L1 where the present proves the past. Proofs establish validity. PoW sets canonical order. Signatureless authorization, execution and recursion share one transparent end-to-end post-quantum stack. V2 adds proof-native contracts: programmable live rights verifiable after pruning. Nodes verify state and rights from genesis without replay or trusted checkpoints. Block bodies and transactions are pruned after retention. Receipts remain verifiable. Mainnet is live.
Website · Documentation · Research · Releases
Source: Forgejo (canonical) · GitHub · GitLab
V2 extends that model to proof-native contracts. A live output can commit to a program, authorities, recipients, height conditions and persistent counters. Spending it proves not only ownership of value but the right to take a particular action: collect a payment, spend a budget, claim a due installment or recover a remaining balance.
The authorized transition produces a new committed state or closes the right. Its validity becomes part of the same block proof. Nodes do not need a growing contract execution history to validate the present. Applications retain the public terms and portable receipts they need to use and explain that present.
The shared integer core has 16 instructions, two persistent u64 counters, two scratch registers, checked arithmetic, conditions and block-height access. Users can create programs within this ABI without a new circuit or matrix per application. It is a bounded core: scheduled actions require an authorized call, and there are no loops or cross-contract calls.
The GUI, CLI and RPC expose six templates plus custom programs:
- refundable payments;
- timelocked vaults;
- delegated allowance wallets;
- budgets per height period;
- recurring payments;
- gradual release in fixed tranches.
This opens application space around prepaid services, delegated spending, conditional access and staged payments while keeping consensus storage tied to live rights. Each deposit is an independent instance. The concept, contract guide, API and GUI walkthrough explain the mechanics and limits.
Pruv compiles readable contract programs into the existing native ABI. It checks types and resource limits, exports definitions for the current CLI, and verifies declared postconditions with Z3.
- The wallet builds an atomic intent and proves knowledge of the required spending secret, bound to the complete logical transaction.
- The mempool checks authorization, current spendability, limits and fees.
- The miner proves the selected payments and contract calls, exact slot writes and recursive continuity with the parent.
- Only then does an internal or external worker search the immutable Poseidon2b header's 128-bit nonce.
- Peers verify the proof, PoW and chain rules, then apply the proven writes.
Hashpower alone cannot originate a block. A producer needs current State and a completed proof. An external worker receives a single-use nonce template; transaction selection and proving remain in the node.
Each HistoryStep proves the current block relation and verifies the previous
terminal inside the same relation. For a fixed network profile, proof size and
terminal verification work do not grow with chain height.
A joining node validates compact headers for cumulative work, authenticates a finalized State with its matching proof, then verifies the recent block suffix. Header validation scales with chain height; State transfer scales with live outputs and rights. Historical transaction execution is covered by the recursive proof.
An active node keeps the live State, permanent compact headers and a 42-block body-serving window. The synchronization guide describes the authenticated snapshot and recent-suffix paths.
| Parameter | Value |
|---|---|
| Mainnet genesis | 2026-08-21 16:00:00 UTC |
| Genesis block ID | 860e70453390bf815718e933aa4927167a13d098b0151391eefd722ee1add610 |
| Target block interval | 30 seconds |
| ASERT | 6-block reference epoch, 180-second half-life |
| Default Small | m23: 63 pages, 504 live inputs, 63 contract calls |
| Optional Large | m24: 206 pages, 504 live inputs, 63 contract calls |
| Hard finality / maximum reorg | 18 / 17 blocks |
| Local body retention | 42 blocks |
| State domain | 2^24 to 2^32 slots |
| Serialized terminal cap | 1,100,000 bytes |
Page, input and call limits apply together. Small fits 63 one-page payments or 63 calls; Large fits 206 one-page payments or 63 calls plus 143 payments, within the input budget. A multi-page spend remains one logical transaction. The primary coinbase is separate; an additional mandatory system page consumes one effective page.
Large production is a server option, --v2-large-blocks, with no GUI switch.
It permits fee-based class selection and does not force Large blocks. Every
node verifies both classes. Ordinary one-page capacity ceilings at the target
interval are 2.1 and about 6.87 transactions/s; these are capacity calculations,
not measured sustained network throughput. See parameters
and measured proving and verification costs.
State is an exact sparse vector of indexed outputs. Spending clears a slot;
new outputs reuse empty positions with fresh creation_id values. Empty
2^16-slot segments need no materialized payload. Sustained finalized occupancy
can expand the domain without moving existing outputs.
Issuance follows an exact height schedule from H210537: 16 → 11.30 → 8 → 5.65 → 4 → 2.83 → 2 → 1.41 → 1 NOID, one step every 1,051,200 blocks. The permanent 1 NOID tail means there is no fixed maximum supply. State expansion does not change the reward.
Occupancy still increases the fee for net-new live slots. That growth component is burned; consolidation frees slots and avoids growth fees. The network economics explains the schedule, its rationale and the distinction between gross subsidy and actual supply.
Parano1d has no premine. For the original three 365-day target-time years from genesis, the consensus subsidy allocation is:
- 90% to the miner;
- 5% to the O(1) Network Fund;
- 5% to Parano1d Lab.
The allocation ends at block 3,223,778. After that, 100% of new block subsidies go to miners. Transaction fees remain entirely miner-claimable after the state-growth burn. The allocation schedule details the daily payouts and accounting.
The O(1) Network Fund finances operation, maintenance, security and adoption of the live network. Parano1d Lab supports the founders, core developers, researchers and contributors advancing the protocol. Both will publish periodic reports covering funds received, major expenditures, completed work and current priorities.
Committed traces use GF(2^128); C1 Fiat–Shamir challenges and recursive claims use GF(2^256) with a trace-one support of size 2^255. Poseidon2b underlies addresses, transactions, trees, transcripts and PoW. FROST-GKR batches its permutations and Merkle paths; sumcheck, zerocheck, lincheck and FRI-Binius close the relation without a trusted setup.
The FROST-GKR research article links the paper, reference implementation and reproducible comparison with per-permutation reductions.
Ordinary ownership uses a freshly randomized proof of a 256-bit secret's preimage, with no public-key transaction signature. Wallet authorization contains no Live State Merkle path and is independent of the current State root. The miner proves current input membership and exact State updates in the block relation. Contract calls prove the active policy authority. The libp2p Ed25519 identity identifies a peer only. Public addresses, values and relayed transactions are not concealed, and third parties can archive them. Pruning is not an anonymity guarantee.
The final v2 bank and matrix-retirement construction have source-linked soundness accounting, including legacy ancestry. Under the stated all-root composition, ideal compiler, honest public preprocessing, fixed-Poseidon2b and resource-price premises, the Category 1 assessment gives a dominant gate-depth floor with log2 value 173.3897612554174 and an ideal success bound of about 0.04937388373372754 at the Category 1 reference envelope. The premises and exact resource bounds are detailed in the security model and exact final-bank records.
The fork binds the new proof to the selected last old block. Release builds omit the old matrices and verify that ancestry through retirement certificates under independently pinned keys. Old runtime metadata and the two v2 matrices remain part of the verifier.
Nodes running v2.0.3 continue to work with their embedded legacy matrices and support both certificate formats. Matrix retirement changes the packaged verification material while retaining the same mainnet consensus rules.
The official wallet participates in the P2P mesh through its own node. DNS seeds supply initial peer addresses. Kademlia, local mDNS and persisted peer addresses support ongoing discovery. Once stable ordinary neighbours are available, nodes replace their bootstrap seed connections.
libp2p GossipSub carries transaction intents and compact block announcements. Nodes fetch State, block bodies and proofs from peers through bounded requests and verify the data locally. See networking for discovery, peer diversity and transport limits.
Official releases contain a Core archive and a native GUI wallet with its own supervised node. The GUI supports Linux, Windows and macOS. See installation and Core.
parano1d --check-hardware
parano1dFor mining:
parano1d --miner
parano1d --miner --v2-large-blocksExternal nonce search keeps proving in the node:
parano1d --extminer --mining-key-file ~/.parano1d/mining.key
parano1d-miner --key-file ~/.parano1d/mining.keyUse only the mining command appropriate to the host. Default ports are P2P 9600 and local JSON-RPC 127.0.0.1:9601. The built-in wallet key is not password-encrypted; protect it and back up contract terms and receipts too.
parano1d-cli status
parano1d-cli balance
parano1d-cli contract protocol
parano1d-cli contract --helpAddresses use bech32m o1…; 1 NOID = 1,000,000 μNOID. F7 opens Contracts in
the GUI, and F8 opens Settings. See RPC for owner,
mining and operator access scopes.
The wallet saves outgoing payment receipts locally while the confirmed block data is available. Export a saved receipt for a payment to a different owner:
parano1d-cli receipt TXID > receipt.hex
parano1d-cli verify "$(tr -d '\n' < receipt.hex)"For a retained contract-call receipt, use the saved contract terms and a
confirmed call ID. Replace contract.json and CALL_TXID with your file and
transaction ID; --out must name a new file:
parano1d-cli contract receipt contract.json CALL_TXID --out call.receipt
parano1d-cli contract verify call.receiptBoth receipt formats remain verifiable after the block body is pruned. Keep public contract terms and receipts with your backups. A receipt establishes a past payment or call; current spendability is checked against authenticated State. See payment receipts and contract receipts and recovery.
The workspace pins Rust 1.96.0. Native builds need a C/C++ toolchain, CMake, libclang and platform packaging tools. Production x86-64 requires SSE4.1 and PCLMULQDQ; ARM64 requires NEON and PMULL. Portable binaries select the available PCLMUL, AVX2+VPCLMUL, AVX-512+VPCLMUL or NEON+PMULL backend at runtime.
A production build requires the authenticated v2 bank, reviewed pins and legacy ancestry material. The build guide provides the complete generation, authentication and packaging procedure. Contract programs use this shared bank and do not generate new matrices.
./scripts/build_release.sh \
--pack PATH_TO_LEGACY_PACK \
--v2-pack PATH_TO_FROZEN_V2_PACK \
--v2-pins PATH_TO_REVIEWED_PIN_FILE \
--retirement-keys PATH_TO_AUTHENTICATED_KEYS \
--retired-historyDesigned and developed by Ignotus Nemo. Apache License 2.0. Report security issues through the security policy. Contact: dev@parano1d.org.