Index#
| Record | Status | Date |
|---|---|---|
| D1. Session authorization V1 | Candidate not approved for production | Protocol 0.2.0, 2026-09-09 |
| D2. Genesis-native formats, no migrations | Accepted | 2026-10-01 |
| D3. Unbiasable randomness beacon | Proposed | 2026-09-17 |
| D4. ECRecover repriced to 9,000 gas | Accepted | 2026-09-26 |
| D5. SELFDESTRUCT sweeps only | Accepted | 2026-09-26 |
| D6. Plaintext mempool, disclosed | Accepted | 2026-09-26 |
| D7. Anchor-authenticated peer sampling | Proposed | 2026-09-30 |
D1. Session authorization V1#
Principles. Authorization is deterministic, bounded, non-programmable and visible to consensus. One value has exactly one encoding. Worst-case work is charged before expensive work starts. New authority is delayed, while revocation takes effect as soon as it is finalized. Root, session, validator and network keys stay separate roles.
| ID | Decision | Reason |
|---|---|---|
| D-01 | Keccak-256 with original padding, with a unique domain label per construction | Reuse one reviewed primitive; known-answer tests catch an accidental SHA3-256 substitution |
| D-02 | Ed25519 everywhere; P-256 for session keys only | One verification core shared with the EVM precompile; passkeys without changing any other key type |
| D-03 | A root witness carries exactly threshold signatures, sorted by key ID | Predictable cost and size, and no alternative signed representations |
| D-06, D-07 | One account format from genesis; no compatibility with prototype state | No dual decoders or lazy migration in consensus code |
| §5 | A refundable grant deposit instead of recurring state rent | Owners pay for the state they occupy, and a cleanup bounty clears expired grants |
| §13 | A security reserve that only ROOT can spend | An emergency revocation is always affordable |
Guardian recovery was excluded from V1 by decision D-16.1 and later added as a separate, delayed, opt-in extension.
D2. Genesis-native formats#
Decision. Reject incompatible state instead of rewriting identity or inferring missing fields. Historical manifests, metadata rewriting and share-less staking interpretations were removed. A semantic change requires a coordinated fresh genesis; a restart on the same protocol reuses existing data and signing records.
Cost. No in-place upgrades during development. Upgrades after a production genesis will need explicit migration specifications.
D3. Unbiasable randomness beacon#
Proposed
Problem. Today's beacon is the winning proposer's VRF output. A winner who dislikes its output can withhold the block and get one retry, which turns a fair coin into a 3/4 coin. Contracts therefore must not read the beacon, and an EVM randomness precompile stays blocked.
Proposal. A threshold beacon with t = f + 1 of n = 3f + 1, to be built as threshold BLS with distributed key generation. Any t shares reconstruct the same output, so a Byzantine minority has no alternative to steer toward. Fewer than t shares reveal nothing about it.
| Simulation | Result | Expected |
|---|---|---|
| Current beacon, one withholding proposer | 3,014 of 4,000 wins (0.754) | About 0.75: biasable |
| Commit-reveal, last revealer withholds | 2,971 of 4,000 (0.743) | About 0.75: one bit of choice kept |
| Threshold beacon, Byzantine minority | Identical output in 200 of 200 epochs | Exact: unbiasable |
| Threshold beacon, prediction below threshold | 997 of 2,000 (0.499) | About 0.50: no signal |
Status. A prototype uses Shamir sharing over the Mersenne field 2127 − 1 and proves uniqueness, hiding and quorum agreement. Nothing in consensus imports it yet; key generation, share authentication and transport remain.
D4. ECRecover at 9,000 gas#
Context. Recovery in pure Go costs about 184 µs. At Ethereum's 3,000 gas, a block full of recoveries burns about 1.8 s of a 2 s slot, leaving no time for gossip, signatures or commit.
Decision. Price it at 9,000 gas, so a saturated block costs about 0.61 s. Output and success behavior stay identical to go-ethereum; only the price differs. Manifest revision 24.
Rejected. Halving the block gas limit, which penalizes every workload; per-attempt pricing, which adds consensus surface for no measured benefit; keeping 3,000 gas, which risks missed slots.
D5. SELFDESTRUCT sweeps only#
Decision. SELFDESTRUCT moves the contract's full balance to the beneficiary and halts. Code, storage, nonce and the account always survive, even for a contract created in the same transaction.
Rejected. Pre-Cancun full deletion, which Ethereum itself abandoned and which would need a new deletion primitive in state. EIP-6780 same-transaction deletion, which needs the same machinery and state-root churn, and imports Cancun semantics onto a Shanghai opcode surface for one narrow edge case.
D6. Plaintext mempool, disclosed#
Decision. Pending transactions stay readable by any peer, and block ordering stays a local convention: control transactions first, then nonce-sequenced fee priority. Integrators are told to use slippage bounds, deadline heights and private submission where available, and never to put secrets in calldata.
Deferred. A threshold-encrypted mempool and commit-reveal ordering; each needs its own protocol proposal. Rejected. A consensus-enforced ordering rule, which would turn benign deviations into faults without stopping a Byzantine proposer.
D7. Anchor-authenticated peer sampling#
Proposed
Problem. A node that loses its anchors has no other way to find peers on the open internet.
Decision. Connected anchors that passed the compatibility handshake may refer up to 16 live peers each, at most two per subnet, leased for one hour. There is no DNS, no transitive referral and no persistent referral cache. This is bounded sampling, not a claim of Sybil resistance.
Sources: Decision records in the reference implementation's documentation, with their linked specifications and simulations.