SATOSHI
Every coin its own chain. Every creator fee a block reward.
A proof-of-work schedule grafted onto Solana. Every coin minted here is its own ledger, with a genesis block, a difficulty that doubles and a reward that halves. The fees its trading throws off are its hashrate, and every wallet that holds it is a miner, paid in proportion to how much it holds and how long it has refused to sell.
On 3 January 2009 a program with no users wrote 285 bytes to disk and called them block 0. Everything that followed, the halvings, the difficulty, the twenty-one million, was already present in those bytes as a rule rather than a promise. This paper describes a machine that gives every coin launched on Solana its own copy of those rules. Each coin keeps a private chain of height h. Its creator fee is the only source of value, and it is spent only when the fee vault crosses a target Dh that doubles every 21 blocks. The share of each block paid to miners halves on the same schedule, and the remainder buys the coin and destroys it. Because the target doubles exactly as the share halves, their product never moves: every block, at every height, pays miners the same minimum, and every block after the first epoch burns more than the one before. Mining is holding. Hashpower is coin held, multiplied by time held, multiplied by how long the streak has gone unbroken.
1Block 0
The genesis block carries a timestamp of 1231006505, which is 18:15:05 UTC on Saturday, 3 January 2009. Its previous-block field is thirty-two zero bytes, because there was nothing before it. Its first transaction, the one a miner is allowed to write out of thin air, pays 50 coins to a public key. Before the payment, in the space where the protocol permits arbitrary data, it carries a sentence copied from that morning’s front page of The Times of London. It is highlighted in the dump below.
The headline does two jobs. As a timestamp it proves the block cannot have been made before that morning, so no one had a head start. As an editorial it names what the system was built to route around. Those are the actual bytes, and the page you are reading has just hashed them. Feed the 80-byte header twice through SHA-256 with the nonce 2083236893 and the result begins with forty-three zero bits, eleven more than the difficulty of the day required.1
The 50 coins it pays can never be spent. The reference client never added that first output to its table of unspent outputs, so the first reward in the history of the system is permanently out of circulation. Block 1 did not appear until 9 January, six days later. No one knows for certain why.
2Twenty-one million
Bitcoin has no issuer, only a schedule. The block reward began at 50 and halves every 210,000 blocks, about every four years at ten minutes a block. The halvings arrived at block 210,000 in November 2012, 420,000 in July 2016, 630,000 in May 2020 and 840,000 in April 2024. Because the reward is a geometric series, its sum converges:
The real figure is 20,999,999.9769, short of the round number because the reward is rounded down to whole satoshis at every halving. After the 33rd halving it rounds to zero, somewhere around the year 2140, and from then on miners are paid only from fees.
The other half of the schedule is difficulty. Every 2,016 blocks, every node compares how long those blocks actually took against two weeks and rescales the target by that ratio, clamped to a factor of four in either direction. Supply is fixed by height, and height is fixed to the wall clock. A single integer, bits = 0x1d00ffff in block 0, carries all of it.
3What work buys
Proof of work is often described as wasted energy. It is closer to a receipt. A valid hash is evidence that its finder burned a measurable amount of electricity, and the block reward is what makes the burn rational. The security of the ledger is the cost of redoing that work, and that cost is paid out of the reward.
This is where the design has its tension. The reward halves without asking whether fees have grown to replace it. The schedule is indifferent to price, sentiment and the people who rely on it, and that indifference is the property everything else depends on. A rule that can be adjusted when it becomes inconvenient does not constrain anyone.
4A second genesis
Solana’s mainnet-beta began on 16 March 2020. Its genesis hash is 5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d. It has no miners. Leaders are scheduled by stake, and instead of searching for a hash below a target, a validator runs SHA-256 in sequence, feeding each output back in as the next input. That chain of hashes, Proof of History, is a clock: it cannot be computed faster than it can be computed, so its length is evidence of elapsed time. A slot is about 400 milliseconds, and the counter at the top of this page is Solana’s live slot.
The two systems use the same function in opposite ways. Bitcoin runs SHA-256 in parallel to win a lottery; Solana runs it in series to keep time. One produces scarcity, the other throughput. Neither had a way to give a single token the scarcity machinery of the first while it lives on the throughput of the second.
pump.fun, which opened in January 2024, made launching a coin on Solana cost almost nothing. Every trade on its curve, and later on the pool the coin graduates into, pays a small creator fee. That is a stream of revenue with no work attached and no schedule governing it, which is the problem Bitcoin was built to solve. Here the stream becomes the block reward. And because a coin here is named for the slot it was born in, every miner carries its own position on Solana’s clock as its identity.
5The machine
Every coin launched here is created through pump.fun with its creator set to a fresh vault key, so its fees collect where the machine can reach them. A coin that already exists can be brought in by importing its creator key, so a miner can be paired with almost anything already trading. From then on a process called the keeper runs the chain. Every pass it does three things:
| step | what happens |
|---|---|
| snapshot | Reads every wallet holding the coin and adds the work each one did since the last pass. |
| settle | If the creator vault holds the target for this height, claims it, credits miners their share, buys and burns the rest, then h += 1. |
| pay | Sends SOL to every miner whose credit has passed 0.001. Nothing to claim, nothing to stake. |
Let e = ⌊h / 21⌋ be the epoch, which plays the role of Bitcoin’s halving count with 210,000 blocks shrunk to 21. A block is found when the vault holds at least the target:
Settlement sweeps the vault, V ≥ Dh. A share sh of it is paid to miners, and the rest buys the coin and destroys it:
The two exponentials are conjugate. Multiply them and the epoch cancels:
This is the invariant the protocol is built around. The minimum paid to miners per block is the same at every height, forever. The halving does not reduce what a block pays. It reduces how often a block can be found, which is what happens to Bitcoin miners in practice. Everything above the minimum is destroyed, and the destroyed share approaches one without reaching it. Every burn is paid for by trading that already happened, so the coin is never destroyed faster than people are willing to trade it.
Hashpower is holding through time. Between two passes, a wallet does work equal to the balance it held across the whole interval, times the seconds elapsed, times a multiplier for how many days d its streak has gone unbroken:
Only the balance held across the whole interval counts, so buying the second before a snapshot earns nothing. Selling any of it resets the streak. One unbroken day doubles a wallet’s rate, three days triple it, a week quadruples it, and it keeps climbing slowly for as long as the coin is held. When a block settles, each miner is credited in proportion to the work it did since the last one, and every wallet’s work goes back to zero:
Credits are paid out automatically once they pass 0.001 SOL. There is nothing to claim and nothing to stake. If the coin is in your wallet, you are mining.
6The schedule, worked
The table assumes each block is settled the moment the vault crosses the target. Settling later makes the sweep larger and the burn larger. It never changes the miners’ floor.
| epoch | blocks | target | to miners | burned |
|---|---|---|---|---|
| 0 | 0 to 20 | 1·D0 | D0 | 0 |
| 1 | 21 to 41 | 2·D0 | D0 | 1·D0 |
| 2 | 42 to 62 | 4·D0 | D0 | 3·D0 |
| 3 | 63 to 83 | 8·D0 | D0 | 7·D0 |
| 4 | 84 to 104 | 16·D0 | D0 | 15·D0 |
| 5 | 105 to 125 | 32·D0 | D0 | 31·D0 |
| 10 | 210 to 230 | 1,024·D0 | D0 | 1,023·D0 |
| 32 | 672 to 692 | 4,294,967,296·D0 | D0 | 4,294,967,295·D0 |
By epoch 32 a block asks for more than four billion times its first target, and pays miners the same as block 0 did. That is the analogue of 2140: the reward stops being a meaningful share of anything, and almost every unit of the fee is converted into scarcity. It arrives at block 693, after thirty-three halvings, as it does in Bitcoin.
7Failure modes
The keeper holds the vault keys, so the rules are enforced by a process rather than by consensus. Everything it does is public. Every block is recorded with the transaction that claimed the fees, the work each miner had done, the share each was credited, and the transaction that burned the rest, so anyone can check the schedule was followed.
If the keeper stops, nothing is lost. The fee waits in the vault and the height stays where it is. A single pass never credits more than ten minutes of work, so no one is paid for a long gap. When it comes back, the next sweep is larger. The failure mode is a pause, and a pause only makes the next block bigger.
Satoshi left after two years and the schedule continued without him. That is the only test that matters for a system like this.
