Security Margins

How strong the proofs are, how big the trees are, and what a quantum computer would change.

How much is “100 bits”?

The final proof is set at 100 nominal bits (7 queries × 10 bits + 30 bits of proof of work), under the proximity-gap conjecture every deployed FRI system relies on. Its strong form was disproved in 2025. The proven figure for these parameters is about 40–65 bits classically, depending on which theorem one accepts, and roughly half that against a quantum attacker.

The project’s position: fine for a signet; for mainnet, at least 112 nominal bits (9 queries, about 11 kvB more per settlement), with the proven figure stated beside it. All the value sits in one output, so one forged settlement could drain the pool. The margin should be bought.

Capacity and keys

Both trees have depth 48. A nullifier-key collision makes the later note unspendable: a freeze, not a mint. By calculation, about 5·10⁻⁵ chance at 10¹² nullifiers by accident, and about 2⁹³ work on purpose.

Quantum computers

• The proofs: hash-based. A quantum computer does not break their soundness beyond the usual halving of security bits.
• Payment-code handshakes (X25519): exposed. A recorded handshake could later reveal a pair’s amounts and links. Privacy, not funds.
• The pool coin’s own taproot output: exposed, like every taproot output. A large quantum computer could in principle compute a key for its key path and skip the covenant. This is Bitcoin’s problem to fix with a soft fork; the pool would then need to migrate to a quantum-safe output type (upgrades).