A cryptocurrency without blocks

Most cryptocurrencies gather the world’s payments into blocks and settle them one block at a time, so every payment waits its turn. Orien has no blocks and no global line.

Each account numbers its own payments. A payment says, in effect, “account A, payment #7: send 5 coins to B”. A validator votes for it if it has never seen a different payment #7 from A, and A can afford it. When validators holding more than two thirds of the stake have voted, the votes together form a certificate.

Two conflicting payments can never both get one: any two groups holding more than two thirds of the stake share at least one honest validator, and an honest validator votes for only one payment #7.

Final in two steps. The wallet hands the certificate back to the validators, and the payment is final once more than two thirds of the stake confirm they have recorded it. The wallet keeps a receipt holding both sets of signatures, which anyone can check for themselves, without asking a validator.

The signatures most cryptocurrencies use today will be broken by large quantum computers. Orien uses hash-based signatures instead, whose safety rests only on the BLAKE3 hash function, which quantum computers cannot break that way.

One key per payment. A hash-based key may safely sign only once, so every payment is signed with a fresh one-time key and names the key for the account’s next payment. “Never sign two different payment #7s” and “never use a key twice” become the same rule, and the validators enforce it.

Spare keys. Every address also commits in advance to sixteen spare keys. If an owner ever does sign two different payments with one key, the next checkpoint cancels both and the account carries on with a spare key. Nobody who learns the burned key can touch the spares.

Validators sign in batches. A validator gathers every vote and confirmation asked of it in the last few milliseconds and signs them all at once, so one signature covers many payments.

Once an hour the validators pause for a moment and agree on a checkpoint: a short summary that fixes every balance at that moment. It is the only time they need to agree on anything, and no payment waits for it: a payment sent during the pause simply goes through a moment later.

At each checkpoint the network also:

• frees any account whose owner signed twice, onto its next spare key;
• chooses the next hour’s validators from the coins staked behind them;
• pays the hour’s fees to the validators;
• releases the hour’s new coins and pays them for the work done in that hour;
• takes the stake of any validator caught cheating.

Each checkpoint names the one before it, back to the network’s starting file. A wallet or a new validator checks them in order and so learns who the validators are, without trusting anyone’s word. A validator that has been away catches up the same way, and needs to keep only its last few hours of data.

Anyone can become a validator by staking at least 10,000 coins behind a server. At each checkpoint, the largest stakes are chosen, up to 33 validators, and a newcomer’s server is found by the address it names when it stakes.

Launch seats. The validators that start the network hold seats that share 3 million coins of voting weight. Their weight shrinks as real stake arrives, and once real stake reaches 3 million coins the seats step away for good, leaving the network to those with coins at stake. Seats earn no fees and no new coins.

Unstaking releases coins after a week (168 hours), so a validator cannot cheat and leave with its stake before the proof of it is acted on.

Cheating costs everything staked. A validator that votes for two conflicting payments, or signs two things with one key, leaves proof in its own signatures. Other validators pass that proof on, and at the next checkpoint the cheater’s whole stake, including coins waiting to be released, is burned and it leaves the list.

Minimum stake

10,000 coins

Most validators

33

Unstaking takes

1 week

Launch seats

3 million coins of weight, fading

Every payment pays 0.1% of its amount, never less than 0.000001 coin and never more than 1 coin. A share of the amount keeps the fee about the same in real terms however much a coin is worth; the minimum stops floods of tiny payments, and the maximum keeps large payments from paying far more than the work they cost. Staking and unstaking pay the minimum.

Fees gather over the hour and are paid at the checkpoint to the validators with real stake, in proportion to it. Fees gathered while no validator has real stake wait for the first ones that do.

No coins exist at the start. There is no pre-mine, no sale and no share for anyone. At most 100 million coins will ever exist, each divisible to nine decimal places.

Released smoothly, halving every four years. Half of the 100 million is released in the first four years, half of what remains in the next four, and so on: about 1,977 coins in the very first hour. Coins follow the clock rather than the number of checkpoints, so an hour that closes early or late changes nothing about how many exist.

Earned by work. Miners look for numbers that, hashed with BLAKE3 together with their account and the hour’s seed, come out below a target. Each such number is a work share. Validators collect the shares, and at each checkpoint the hour’s new coins are paid out in proportion to them. The target moves each hour to keep about a thousand shares an hour, however many people mine.

The seed of each hour is the checkpoint before it, which nobody can know in advance. The very first seed comes from a Bitcoin block announced ahead of time, so nobody can mine before everyone else. Work only creates coins; it never decides which payments go through.

• One assumption. Every signature, every proof and all mining rest on the BLAKE3 hash function alone.
• Up to a third may misbehave. As long as validators holding more than two thirds of the stake are honest, no two conflicting payments can both become final, and nothing final is ever lost.
• Nobody needs to be trusted on their word. Votes, confirmations, checkpoints and proofs of cheating are all signed and checked on arrival. Wallets and miners take balances and the work target only from checkpoints they check themselves.
• Open to the internet. Validators limit how many connections any one address may hold and close connections that stay silent or send junk.

These figures come from real validators that write every vote to disk before answering, with no in-memory shortcuts.

Final, across the internet

about 160 ms

Payments per second, one laptop

950 to 1,500

One signature

1,248 bytes

Signatures checked per second, one core

about 40,000