EDYN — Proof of Participation

1Abstract

EDYN is an ERC-20 token on an Ethereum L2. Its supply is capped at 21,000,000 and released on a fixed halving calendar. What makes it unusual is not the cap — many tokens have one — but what the cap is for. EDYN can only be minted against acts of participation in a physical residential community: work that someone did, in a place, that somebody else can point at.

That creates an obvious problem. Elysium Communities operates those places. It publishes the work, decides what it was worth, and holds the key that mints. Any honest description of such a system has to answer one question before any other:

What stops the operator from minting itself money and calling it participation?

The usual answers do not survive contact with a residential community. Make it trustless is unavailable — nobody has solved verifying physical reality without a trusted witness. Make residents approve every payment was our first design, and it failed for a reason worth stating: it taxed the honest party. Thousands of people performing weekly ceremony to authorise work nobody doubted, while a dishonest operator lost nothing but a vote.

EDYN’s answer is narrower and, we think, more durable:

Nobody approves anything. Anyone may object. Being overruled is expensive.

Attested work mints by the clock after a 72-hour public window. Any resident may dispute specific items under a small refundable bond. A quarter of a community may freeze an entire week. Elysium’s own three-person panel rules on disputes — and every time it rules against the town, that ruling bills Elysium’s own capital, from a bond it cannot withdraw for ten years.

The check is not a vote. It is an invoice.

2The problem this actually solves

A residential community runs on contribution that nobody counts. Someone organises the Saturday market. Someone notices the gate is broken and gets it fixed. Someone shows a new family where things are. None of it appears in rent, none of it appears in any ledger, and the people who do it subsidise the people who don’t.

Points systems address this badly. They are unbounded, they are revocable, and everyone correctly reads them as a marketing device — the operator can print infinite points and take them back at will.

A capped, non-revocable token fixes the arithmetic. It creates a new problem in exchange: the operator now controls a real asset’s issuance.

Everything below is about that second problem. The first one is easy.

3Design principles

Five, in the order they constrain everything else.

1. Silence is free. An honest week requires action from nobody. Work publishes, the window lapses, coins exist. A protocol that needs continuous citizen labour to stay honest will get neither.
2. Disagreement is heard. One resident, acting alone, can freeze a specific payment. A quarter of a community can freeze a week. Neither needs permission.
3. Being overruled is priced. Every time the operator rules against the town, it costs the operator — measurably, publicly, permanently. Not a vote lost. A bill paid.
4. Standing comes from living there, never from capital. One residency, one voice. Staking more buys no more say. Universal stakers — who may hold any amount — have exactly zero adjudication rights, because the largest holder would otherwise be the operator’s own treasury.
5. The walls are not negotiable. Values inside the protocol move through a 14-day public timelock. The corridors those values may move within are immutable. Nobody, including Elysium, can set a parameter outside its wall — not by vote, not by upgrade, not at all. There is no upgrade path.

4The token

A comparison worth making because it is precise rather than flattering: USDT and USDC — the two largest tokens in existence — both hold blacklist and freeze powers, unbounded discretionary supply, and (for USDC) an upgradeable proxy. At the token layer, EDYN is more constrained than either. That claim is narrow and we do not extend it: EDYN’s constraints at the token layer say nothing about the discretion Elysium holds over the inputs, which §9 addresses honestly.

5Emission

Calendar eras, halving every four years from genesis.

An era ends when its total has been issued, not on a date. A window can pay at most its share of the era's budget times the burst dial, so an era cannot end in fewer than 52 fortnights at the launch dial (about two years), and there is no upper bound: quiet years simply make an era last longer. No calendar percentage of the 21 million is promised.

The quarterly retarget

The calendar is fixed; participation is priced against it. Every quarter:

rate = window budget ÷ units of work attested last quarter

Work is denominated in units — a stable, human-meaningful measure (“this act is worth 100 units”). Units convert to EDYN at the current rate.

Worked example. The budget is 100,000 EDYN. Last quarter saw 200,000 units of work, so the rate is 0.5 — a 1,000-unit serial pays 500 EDYN.

Next quarter, activity doubles to 400,000 units. The budget is unchanged, so the rate falls to 0.25 — the same serial now pays 250 EDYN.

Same work, half the coin, because a fixed budget is shared among more people. Busy quarters mint less per act. Nobody sets the rate; both inputs are measured. Unminted remainder rolls forward, and a burst ceiling caps any single window at twice its base budget.

This is the mechanism by which the 21M cap enforces itself without anyone choosing to enforce it.

The Inception Tranche

Up to 1,000,000 EDYN (~4.8% of supply) for the founding work that made the community exist: land secured, entity capitalised, platform built, permits obtained, founding cohort assembled. Each act is declared and published individually and passes through the same machinery as everything else. It is not minted outright, and it is the one class of act that is individually public rather than privacy-batched — an escrowed corporate promise has no personal privacy interest, and its visibility is the point.

6From act to coin

declare → claim → attest → daily batch → 72-hour audit window → mint

Declare. A sponsor posts an act on-chain: a content hash, a reward ceiling, a community. The ceiling is fixed in the same transaction and can never rise. No funded declaration, no possible payment.

Claim. Participants signal that they took part. Each claim is their own signed statement, relayed so they never pay gas. (The on-chain path exists — recordClaims and a claimDirect escape hatch — but the app surface that gathers claims is not yet built. Today the judge attests directly.)

Attest. The judge names who did what and what each is owed. This is the anti-freeloader control, and it is the point at which a human being takes responsibility for a factual assertion.

Batch. A day’s attestations roll into a single Merkle root per community. Per-act totals are public; individual amounts exist only inside hashed leaves.

Audit window. 72 hours. Anyone with standing may dispute. Nobody has to approve.

Mint. The window lapses and EDYN lands in the earner’s wallet. A serial mints only with a valid Merkle proof, an unused nullifier, and remaining budget in its declared act’s cap.

The single most important property of this pipeline is what happens when nothing happens: the work gets paid. The town’s power is the option to object, never the obligation to approve.

7What residents can do

Challenge — one person, specific items

Any resident of that community whose stake is at least 14 days old may name serials during the audit window. Each named serial must carry a Merkle proof binding it to that batch, so nobody can freeze work they have no standing over.

The bond is 0.00001 EDYN per serial named — linear, so thoroughness is never taxed — and doubles for each additional separate challenge the same person opens in the same period, so pestering becomes expensive on its own.

Three arbiters rule, 2-of-3:

Two rows deserve attention.

A sustained challenge costs Elysium nothing in marks. The system caught an error and corrected it. That is the process working, not misconduct, and pricing it would teach the operator to fight corrections.

Silence loses. An unanswered challenge kills the serial and costs exactly what a recorded dissent costs. Under any other rule, ignoring disputes would be the operator’s cheapest exit from every one of them — and a protocol whose cheapest strategy is inattention will get inattention.

The resolution rule, precisely: all three votes decide immediately; at the deadline any majority among votes cast rules, including a single vote — an arbiter who turns up outranks two who did not; a 1–1 deadlock buys one 30-day extension, because a complex batch can genuinely need checking, and then dies. Nothing resolves early unless all three have voted, which is what prevents two arbiters closing a case behind the third’s back to bury a dissent.

The circuit breaker — a quarter of a community, a whole week

If 25% of a community’s staked residencies flag the same completed week:

• That week’s unminted serials freeze
• Minting pauses for that community only — never protocol-wide
• Elysium is billed 10% of the week’s value immediately, before any verdict

The penalty lands on the trip, not the verdict, because assembling a quarter of a community behind one complaint is hard enough that reaching quorum is itself the evidence. 45% goes to the residents who flagged it; 55% is burned.

The arbiters must then rule within seven days: nullify (the week’s serials die — free, we accepted the town’s read) or continue (they mint — 100 to 1,000 marks). Saying nothing auto-nullifies and bills the same as continuing.

Object — pricing an administrative act

Guardian actions and pending parameter changes each open a 14-day window in which residents may object. Objections never undo anything. At 25% quorum they bill marks, and a vetoed action’s bond is frozen at 0xdEaD permanently.

The town cannot undo the operator. It can always, permanently, bill it.

8The Master Bond

Elysium posts 200,000 EDYN, locked for ten years. There is no early-release path in the contract — not a slow one, not a governed one, none.

Marks accrue against it in monthly buckets. Only the trailing twelve months count, so old grievances roll off and accumulation measures a rate rather than a life sentence. Crossing a threshold walks a four-tier ladder:

Top-ups are pulled automatically from a reserve wallet the moment a tier trips. If that pull fails, every new act declaration is blocked until it clears — a sanction cannot be dodged by emptying the reserve.

Be precise about what is lost

Marks do not burn the bond. A sanction forces Elysium to lock more capital (released when the sanction ends) and to declare smaller reward budgets. The base 200,000 returns after ten years.

What is genuinely destroyed is narrower: 55% of every tripped breaker’s penalty burns, and a vetoed action objected to at quorum loses its bond forever.

We state this precisely because the imprecise version — “it loses money every time” — is more flattering and less true.

Magnitude, and why it applies unevenly

Marks scale with the EDYN at stake, but only where Elysium is culpable: a split verdict, a breaker continue, silence. A clean unanimous overrule stays at the flat rate.

The reason is adversarial. The challenger chooses what to bundle into a challenge. If every outcome scaled with size, a hostile resident could name 500 EDYN of perfectly good work, lose, and bill the operator thousands of marks for being right. Scaling only culpable outcomes closes that.

What the ladder means in practice

Simulated across a full year with 7,540 residents:

An honest year sits at under a fifth of the first threshold. Roughly: one breaker continue lands Tier 2; two land Tier 4.

These thresholds are calibrated, not measured. The dispute rates in that simulation are assumptions, stated as named constants in the model. The shape is right; whether real communities dispute one batch in twenty is unknowable until real communities exist.

9What the operator controls, stated plainly

Any honest paper about a permissioned-input protocol has to have this section.

Elysium decides what work happened. Nobody has solved trustless verification of physical reality, and EDYN does not claim to. If Elysium attests to an act that never occurred, no cryptography detects it.

Elysium holds all three arbiter seats. The judge sits on the panel that rules on challenges to the judge’s own attestations. This is the sharpest criticism of the design and we do not have a complete answer to it. What we have is: every ruling against the town is priced, permanent and public, and an independent ethics seat on the panel is under active consideration.

Elysium admits residents. The registrar binds identity to residency, so the population every quorum divides by is one Elysium curates. Fabricating residencies costs real locked capital per residency, the count is public, and the breaker’s denominator is frozen at each week’s close so padding cannot be done reactively. It cannot be made impossible, only expensive and visible.

Elysium can pause and revoke. A dedicated 2-of-3 guardian Safe can revoke operational keys, pause contracts, halt minting for five days, and permanently veto named serials. Every one of those powers is subtractive — it cannot mint, cannot grant a role, and cannot alter a parameter directly. Every use opens an objection window that bills marks.

Two further powers the same Safe holds, which honesty requires naming:

• It is the sole proposer on both timelocks. Every parameter change in the protocol originates with it. It cannot set a value outside the immutable corridor and it cannot shorten the 14-day delay or the objection window that runs alongside — but nothing changes without it, and it decides what is proposed.
• It is the custodian of the CommunityFund, which holds pooled bounty and drop balances. It can move a claim between holders — the mechanism that lets a deceased resident’s balance reach their kin — and can withdraw funds not yet promised to anyone. Balances in that fund are custodial, not self-sovereign, and this paper should not be read as claiming otherwise.

Minted EDYN in a resident’s own wallet is untouchable by anyone. Balances held for residents inside the fund are not, and that distinction matters.

What Elysium cannot do, at all

Mint outside the schedule · exceed the 21M cap · exceed a declared act’s ceiling · freeze or seize anyone’s tokens · upgrade or replace any contract · set any parameter outside its immutable corridor · reverse a mark once it has landed · ignore a circuit breaker without paying for it · withdraw the base bond before ten years.

The claim we actually make is narrower than “trustless” and, unlike it, true: the operator is trusted for the inputs; the rules that turn attested facts into money are beyond the operator’s reach.

10Privacy

Residential privacy is not negotiable, and a blockchain has no delete key — whatever granularity you publish in year one is published forever. So this was decided before the first batch ever posted.

• Resident claims and attestations never post individually. They roll into one daily batch root per community, posted on a fixed clock, publishing per-act totals only. Per-person splits exist solely inside hashed leaves.
• The chain carries fingerprints and aggregates; the readable ledger stays permissioned off-chain.
• Everything remains derivable. The mirror retains all preimages, so any root, balance or split is reconstructible for audit, escrow or dispute.
• Corporate acts are the exception and are individually public.

The design goal: a stranger can verify that the rules were followed without learning what any particular neighbour earned.

11Demand

Why anyone would hold EDYN rather than spend it immediately:

1. Stake to reside. Residency requires locked EDYN for its duration — economically a rental deposit, transferable to an approved incoming resident as a membership deed. The amount is set per community and per unit tier.
2. Restricted tranches. Sold with per-case terms, non-transferable, dues-payable — locking tomorrow’s cost of living at today’s dollars.
3. A holdings-gated privilege ladder. Priority, amenities, purchase limits.
4. Spend-to-replenish covenants. Spending earns discounted repurchase rights.

Every value sink is EDYN-denominated. Gas is operational expense paid by Elysium; residents never see it.

12Governance

Three strata, deliberately unequal:

Immutable. The cap, the halving calendar, the retarget maths, the decimals, the nullifiers, the base bond and its ten-year lock, the number of sanction tiers, and every corridor wall. No mechanism exists to change these.

Timelocked (14 days, publicly objectable). Every tunable value, inside its wall. A pending change is visible for the full period, and residents may object; a carried objection bills marks without blocking the change.

Instant, Elysium alone. Operational matters that are prices rather than powers: per-community tier stake amounts, residency approvals and unassignments, and the six subtractive guardian actions — each of which is billable.

Progressive decentralisation is a roadmap, not a claim. We say what is true today: the operator is the operator. What we offer instead of decentralisation is legibility — every power enumerated in code, every use of it public, every overreach priced.

13Current status and honest limitations

Not deployed publicly. The protocol described in this paper has been built and exercised extensively on local chains, but has never been deployed to a public network. Every existing Base Sepolia deployment runs the superseded v1 design. The next public deployment is gated on creating the production guardian Safe.

No mainnet deployment, no real value, no sale. An independent security audit and securities counsel sign-off are hard gates on all of it.

Verification to date:

• 236 automated tests, including invariants: the cap cannot be exceeded, era budgets are conserved, nullifiers are single-use, nothing mints without a lapsed window, and the bond always holds at least what it has promised.
• A twenty-three-stage live battery that deploys to a real chain and drives every contingency with real transactions and real elapsed time.
• Six adversarial review passes. The most recent ran 52 independent agents across six attack surfaces, each finding refuted before acceptance. Roughly 60 confirmed findings cumulatively, several critical, all fixed with regression tests.

This is pre-audit code. Extensive internal adversarial review is not an audit, and we do not present it as one.

Other honest limits:

• L2 reality. The Base sequencer is operated by one company for ordering and liveness. Ethereum is settlement truth, the chain is fraud-provable, and a force-inclusion exit path exists.
• Keys on testnet are custodial simulation stand-ins. Production uses device Secure Enclave and passkeys.
• The guardian Safe is not yet live. Creating the real 2-of-3 and rehearsing it is a gate on the next public deployment.

14What would falsify this design

A paper that cannot say how it would be wrong is marketing. Here is what would show this design failing:

If sustained challenges are rare and overruled ones common, the panel is not independent enough and the bond is decoration.

If honest operation accumulates marks, the thresholds are miscalibrated and the ladder will punish the wrong behaviour until it is ignored.

If residents never challenge anything, either the protocol is working perfectly or nobody is watching — and those two look identical from outside. This is the failure mode we can least distinguish, and the one we would most want to know about.

If challenges arrive faster than three people can rule on them, silence becomes structural rather than chosen, and the honest earners it kills will be the protocol’s own fault.

If a community’s quorum is never reachable, the breaker is theatre. Watch whether any breaker ever trips at real scale.

We would rather these be measured than argued about. Everything needed to measure them is public by construction.