Paying the Provers
Proving a settlement takes real computers and real electricity. Cheshire pays for it from the contributions’ fees, in notes, by the settlement’s own proof. No one holds the money in between, and no one decides who gets paid.
The idea
Section titled “The idea”- Every proving job’s statement carries a tally: which pay key did the job, at what price.
- Settle-top folds the job tallies into one, and the settlement reserves the total pay,
Σsats, inside the pool’s value. The miner gets the rest. - Six settlements later, a payroll step opens that tally and inserts one note per pay key into the notes tree, with payroll records published like any others.
- The prover’s wallet finds those notes from its seed and the chain, like any other note.
settlement h: jobs proved ──▶ tally of (pay key, pay) ──▶ Σsats held in the poolsettlement h+6: payroll opens the tally ──▶ one note per pay key, in the notes treeWhy a later settlement pays: a settlement’s pay notes would be records in its own batch, and every record feeds the fingerprint every proving job needs before it can start. Paying in the same settlement would be a cycle. Paying six settlements later breaks it: by then proving is long finished and every entry of the tally is public on the share chain.
A prover in a settlement that never confirms is paid nothing, like a miner whose block is orphaned.
The price
Section titled “The price”The price per share is a rule every node computes from the batch:
price = (Σfee − the settlement's Bitcoin cost) / shares rounded downA share here is a unit of proving: one per tree job, one for settle-top and three for the
final proof. The remainder below one share goes to the miner. Σsats = price × shares can
never exceed Σfee, and the pool’s script checks it. A batch is proved only if the price
reaches a floor (100 sat per share by default), so proving is worth doing.
Private pay (since the 2026-11-07 re-pin)
Section titled “Private pay (since the 2026-11-07 re-pin)”Until 2026-11-06, a prover had one lasting “prover code” that appeared in every share and job, and anyone following the share chain could open every pay note and add up each prover’s earnings. That was fixed:
- A prover’s lasting secret never leaves its own node.
- For each settlement, the node derives a one-time pay key from the prover’s seed and that settlement’s starting state. Every job it proves in that settlement binds that key.
- Shares carry no author. Payroll pays
commit(amount, K)to each keyK. - To recover, the wallet recomputes its key for each settlement on chain and keeps the notes that open under it.
What this hides, and what it does not:
| hidden | not hidden |
|---|---|
| which prover a pay key belongs to | what each pay key earned in its settlement (its jobs are public, and so is the price) |
| whether two settlements’ keys are the same prover | that one key’s jobs in a settlement are one prover’s |
| the amount, from someone reading only Bitcoin | a node’s IP address to its peers, and the timing of its shares |
A pool made before this re-pin keeps the old, public codes.
Contributing compute
Section titled “Contributing compute”A node with “contribute” on proves jobs:
- by default only when the computer has been idle for a while;
- with a cap on threads and on memory (a tree job needs about 4 GB, the final job about 10 GB; estimates);
- a tree job takes about 6–7 minutes on a recent Mac.
The node estimates earnings from the open jobs and the current price (GET /earnings).
When no settlement is in flight there are no jobs, and the estimate is zero. See
running a node.
Status
Section titled “Status”Payroll has run with real proofs: in the share-chain run of 2026-10-29, an outside prover was paid six settlements after its first job, rebuilt its wallet from its seed and the chain alone (20,832 sat of pay, exactly what its tallies named), and spent it in a withdrawal. The one-time pay keys were re-pinned on 2026-11-07 and tested with stand-in verifiers and the settlement fixtures; the long real-proof run has not yet been repeated on them.