L1 security engine

Prove it, or lose it.

Proof of Retrievability runs on-chain, at the protocol level. On a fixed interval, the chain forces a random archive to prove it still holds a random chunk — settling a reward, or slashing stake, at consensus.

Challenge interval
100blocks
CHALLENGE_INTERVAL · about 100s
Response window
50blocks
CHALLENGE_TTL
Reward per proof
10Koppa
from the file's fee pool
Slash on failure
5%
of staked balance
Challenge lifecycle

Five steps, every hundred blocks.

No one runs this loop by hand. The chain issues the challenge, the targeted archive answers with a Merkle proof, and validators settle the outcome at consensus.

  1. 1

    Audit

    block_hash → PRNG

    The previous block hash seeds a deterministic PRNG. No human triggers it — challenge generation is built into block execution.

  2. 2

    Challenge

    StorageChallenge

    The seed selects a funded file, a chunk index, and one of that chunk's assigned archives, then writes a StorageChallenge to L1 state.

  3. 3

    Prove

    SubmitStorageProof

    The targeted archive reads the chunk from disk, rebuilds the Merkle tree, and generates the sibling path. It signs and submits SubmitStorageProof inside the response window.

  4. 4

    Verify

    blake3(l ‖ r)

    Validators walk the sibling path: blake3(left ‖ right) from the chunk hash up to the root. The result must equal the on-chain merkle_root.

  5. 5

    Settle

    reward / slash

    A valid proof transfers 10 Koppa from the file's fee pool to the archive. A missing or invalid proof inside the window slashes 5% of its stake. No exceptions.

Interactive

Run a round.

Step through one challenge end to end. Roughly one in seven rounds fails here, to show what slashing looks like when an archive can't produce the proof in time.

PoR Challenge Simulatorinterval = 100 blocks
$ ready. run the challenge to simulate one PoR round.
Challenge lifecycle
1
Select audit target
2
Emit on-chain challenge
3
Generate Merkle proof
4
L1 verifies proof
5
Settlement
Verification formula
verify_merkle_proof(chunk_hash, index, sibling_path, root)
blake3(left_32 || right_32) walked bottom-up must equal merkle_root.
Back to the protocol