{ "project": { "name": "p/btc", "file": "p-btc.json", "schema_version": "1.0.0", "status": "protocol design, not deployed or audited", "settlement_chain": "Bitcoin mainnet", "one_line": "A pump.fun inspired BTC bonding curve with Bitcoin payments and payouts, and a publicly replayable off-chain ownership registry.", "summary": "Buyers pay BTC to unique Bitcoin addresses controlled by a reserve operator. A deterministic registry assigns p/btc units using confirmed Bitcoin transactions and the rules in this file. Holders submit signed sell requests and the operator pays BTC from the reserve. Bitcoin consensus does not enforce the token ledger, curve, fees, or seller payouts. The reserve is custodial until a separately specified and implemented trust-minimized settlement system exists." }, "bitcoin_reference": { "network": "Bitcoin mainnet", "base_unit": "satoshi", "satoshis_per_btc": 100000000, "average_target_block_interval_seconds": 600, "fee_unit": "sats per virtual byte", "payment_model": "UTXO transactions; inputs do not prove which address should receive registry credit", "script_model": "Bitcoin Script has no native fungible token ledger or general-purpose smart contract that enforces this off-chain curve", "address_policy": "Generate unique deposit addresses from a descriptor wallet; use native SegWit or Taproot addresses. Validate network and checksum with a Bitcoin library.", "data_commitment": "Batch registry roots into a dedicated Bitcoin transaction using an OP_RETURN output when policy permits; keep the full event data externally available. OP_RETURN inclusion is a commitment, not execution or validation of registry rules.", "node_interfaces": [ "Bitcoin Core getblockchaininfo", "listsinceblock", "gettransaction", "getrawtransaction", "getblock", "scantxoutset", "listunspent", "gettxout", "testmempoolaccept", "sendrawtransaction", "walletcreatefundedpsbt", "walletprocesspsbt", "finalizepsbt", "signmessage where supported or BIP-322-compatible external signing" ] }, "pump_fun_reference": { "token_total_supply": 1000000000, "token_decimals": 6, "initial_virtual_token_reserves": 1073000000, "initial_real_token_reserves": 793100000, "tokens_reserved_for_post_curve_liquidity": 206900000, "curve_type": "constant product over virtual reserves", "note": "Token-side figures are design inspiration only. A BTC quote reserve, graduation point, and liquidity mechanism must be selected independently; BTC and SOL values are not interchangeable." }, "coin": { "display_name": "p/btc", "total_supply_units": 1000000000, "decimals": 6, "smallest_unit_name": "grain", "grains_per_unit": 1000000, "supply_grains": "1000000000000000", "mint_authority": "The off-chain registry rules fix the supply; Bitcoin does not enforce it.", "where_balances_live": "A deterministic off-chain registry whose snapshots and event logs are published for independent replay.", "position_key": "A registered holder identifier bound to a payout address using a signed challenge. Deposit addresses are unique per intent and never used as proof of sender identity.", "transferability": "No peer transfers in version 1. Holders can sell to the reserve operator and buyers can buy from it. These units are not Bitcoin-native assets, Ordinals, Runes, or BRC-20 tokens." }, "wallet_architecture": { "reserve_wallet": "Operator-controlled Bitcoin descriptor wallet with separate hot settlement and cold reserve controls. BTC funds buys and pays sells; wallet is custodial.", "deposit_addresses": "Create one address per quote and holder identifier; bind it server-side before presenting it, record derivation path or descriptor index, and never infer ownership from transaction inputs.", "settlement_signing": "Use a threshold-controlled wallet or separated signers for reserve spends, with transaction review and limits. Multisignature protects keys but does not make the registry or payouts trustless.", "public_verifier": "Anyone can scan published deposit and reserve addresses and Bitcoin transactions, check registry commitments, and replay published events. Change addresses and all controlled UTXOs must be declared for meaningful reserve accounting; ownership and completeness of that declaration remain assumptions.", "user_wallet_requirements": "A normal Bitcoin wallet can fund a unique address. For selling, the holder must prove control of their registered identity with a supported signed challenge or a separately specified ownership proof. BIP-322 support varies by wallet; provide compatible alternatives without collecting seed phrases or private keys." }, "bonding_curve": { "formula": { "invariant": "virtual_btc_reserve_sats * virtual_token_reserve_grains = k", "buy": "tokens_out = old_virtual_tokens - floor(k / (old_virtual_btc_sats + net_buy_sats))", "sell": "btc_out_before_fee = old_virtual_btc_sats - floor(k / (old_virtual_tokens + tokens_in_grains))", "rounding": "Use arbitrary-precision integers only; specify exact floor and ceil behavior, trade ordering, and fee rounding in implementation tests. Never use floating point for settlement." }, "constants": { "initial_virtual_token_reserves_grains": "1073000000000000", "initial_real_token_reserves_grains": "793100000000000", "post_curve_liquidity_grains": "206900000000000", "initial_virtual_btc_reserve_sats": null, "initial_real_btc_reserve_sats": 0, "k": null, "minimum_buy_sats": null, "graduation_target_sats": null, "note": "BTC parameters must be chosen from a target initial BTC price, expected network fees, dust policy and reserve risk. Do not copy 30 SOL or 85 SOL as BTC figures. Trading is disabled until constants are fixed in an immutable genesis specification." }, "graduation_rule": "When real token inventory reaches zero or an explicitly fixed threshold is reached, stop curve quotes and publish a final snapshot. A BTC-native automatic AMM does not follow from this design. A new post-curve market requires its own protocol, liquidity custody, rules and audit." }, "fees": { "trade_fee_basis_points": 100, "creator_share_of_trade_fee_basis_points": 5000, "operator_share_of_trade_fee_basis_points": 5000, "network_fees": "Buyer pays the mining fee on a buy. For sells disclose expected mining fee, fee-rate ceiling, and exact net payout before signing. Segregate accrued creator fees from the reserve ledger; publish each fee payment transaction.", "fee_warning": "A 1% fee may be smaller than network fees for small trades; set a minimum trade and quote expiry accordingly." }, "transactions": { "buy": { "flow": [ "Register holder identity and payout address through a signed challenge or account authentication", "Request an exact quote with quote_id, deposit address, amount, minimum tokens, expiry height, and chain ID", "Send BTC from any wallet to the unique deposit address", "After the fixed confirmation count, attribute the UTXO by deposit address and quote_id, not input addresses", "Apply the deterministic quote and publish the credit event and its Bitcoin outpoint" ], "confirmations": 6, "ordering": "Order confirmed buys by block height, transaction index in block, then output index. Finality follows the configured confirmation count; reorgs roll back events.", "overpayment_underpayment": "Exact quote matching or an explicitly defined partial-fill and refund policy is required before accepting deposits. A transfer cannot be programmatically rejected on Bitcoin; unexpected funds must enter a publicly tracked refund queue.", "quote_expiry": "Expiry cannot prevent a late Bitcoin payment. Publish a late-payment refund rule, fee allocation, and manual recovery path." }, "sell": { "request": "Holder signs domain-separated p/btc|mainnet|sell|holder_id|amount_grains|min_net_sats|payout_address|nonce|expiry_height with the registered key using a specified verifiable signature scheme. A login alone is insufficient for external ownership claims.", "settlement": "After verification and replay protection, lock the ledger balance, calculate output, construct a Bitcoin PSBT with the exact recipient and fee cap, get threshold signatures, broadcast, and finalize the debit only on the stated confirmation rule. Publish the request hash and settlement transaction ID.", "trust_boundary": "A valid signature authorizes the operator; it cannot force the operator to pay. Signed requests, pending status and disputes must be publicly auditable." }, "refund": "Publish refunds as explicit events referring to original outpoints. Deduct only disclosed Bitcoin network fees; failed refunds stay as liabilities.", "anchor": "Periodically commit a hash of the canonical registry state and event batch to Bitcoin. An anchor proves that a particular digest existed by that block, but cannot prove the operator included every deposit or honored every sell.", "graduation": "Freeze curve fills, publish final inventory and reserve snapshot, and announce the separately implemented post-curve market. Never imply a Bitcoin AMM or trustless pool already exists." }, "registry": { "definition": "Replayable ordered events from confirmed Bitcoin deposits plus published signed requests and reserve settlement transactions. Bitcoin alone cannot yield the full ledger because it does not encode or validate token ownership.", "event_types": [ "genesis", "buy", "sell_request", "sell_settlement", "refund", "creator_fee_payment", "anchor", "graduation" ], "state_fields": [ "sequence", "block_height", "registry_root", "virtual_btc_reserve_sats", "virtual_token_reserve_grains", "real_btc_reserve_sats", "real_token_reserve_grains", "creator_fee_liability_sats", "positions", "pending_refunds", "pending_sells", "phase" ], "canonical_encoding": "Versioned canonical binary encoding with explicit lengths, Bitcoin txid in canonical byte order, vout as uint32 little endian, integer satoshi/grain fields, chain ID, and a domain-separated SHA-256 root. Publish exact test vectors before launch.", "rebuild_procedure": [ "Verify immutable genesis parameters and published wallet descriptors or declared deposit address list", "Read chain blocks from genesis height and map confirmed outpoints to registered quotes", "Download all signed sell requests, refund records and published settlement proofs", "Replay by canonical sequence and deterministic block ordering", "Compare event roots against Bitcoin anchor commitments and reconcile known reserve UTXOs and liabilities" ], "limits": "A verifier cannot prove that the operator disclosed every key, deposit address, private request, or hidden liability. On-chain anchors and UTXO views are evidence, not a proof of solvency or correctness of the entire off-chain book." }, "state_machine": { "phases": [ "unfunded", "accumulating", "graduating", "closed" ], "market_labels": { "compressed": "within 2% of prior anchor spot price", "directional": "more than 2% one direction across three anchors", "dislocated": "one trade moved spot price more than 10%" }, "labels_note": "Display-only classifications; no economic rules change." }, "verification": { "publicly_checkable": [ "Published deposit outputs and confirmation order", "The math for published quotes and events", "Recorded reserve payouts and creator-fee outputs", "Whether published registry roots match Bitcoin commitments" ], "not_trustlessly_guaranteed": [ "Complete disclosure of all controlled reserve keys and liabilities", "Timely execution of valid sells and refunds", "Token ownership and supply enforced by Bitcoin consensus", "Uncensored access to the operator's order service", "An autonomous Bitcoin liquidity pool after graduation" ], "reserves": "Publish a full declared UTXO inventory, controlled-address proof where feasible, obligations and fee liabilities. Never describe an address balance alone as a proof of full solvency." }, "edge_cases": { "late_deposit": "Create a refund liability; never silently fill after quote expiry.", "duplicate_payment": "Track each txid:vout exactly once; extra UTXOs get separate refunds or a documented re-quote.", "reorg": "Roll back unfinalized events and recompute roots; hold sell settlement until confirmation policy is met.", "dust_and_high_fees": "Refuse quotes whose expected net result violates relay dust or stated fee cap; deposits sent anyway are explicit liabilities.", "RBF_or_double_spend": "No credit for mempool transactions; confirmed outpoints are processed after the confirmation threshold.", "offline_operator": "Deposits still reach Bitcoin addresses, but sells, refunds, registry publication and fee distributions pause. Publish outage and recovery procedures.", "lost_operator_keys": "Funds may be unrecoverable; maintain documented threshold backup and recovery procedures." }, "security": { "key_handling": "Never collect user seeds. Keep reserve signing separate from public web services; use hardware-backed or threshold signers, scoped PSBT review, withdrawal limits, logs and backups.", "identity": "Use nonce, domain separation, chain ID, expiry and signature verification for sell requests. Address ownership proof format must be fixed before launch.", "privacy": "Bitcoin deposits and payouts are public and linkable. Do not market this design as a privacy coin or imply it preserves Monero anonymity.", "audit_status": "Design draft only; no implementation, deployment, code audit, or solvency proof is claimed." }, "build": { "components": [ "Bitcoin Core node and descriptor-wallet indexer", "Quote and deposit-address service", "Deterministic registry and published event-log API", "Signed sell intake and threshold PSBT settlement service", "Bitcoin root commitment builder", "Independent verifier CLI", "Website showing exact trade quote, custody status, reserve disclosure and settlement status" ], "deploy_checklist": [ "Choose and publish BTC quote reserve, fee and graduation parameters", "Specify signed identity format, refunds, canonical event serialization, and test vectors", "Test all flows on regtest including reorg, RBF, dust, expired quotes and signer outage", "Audit custody and ledger code, segregate reserve keys, test backups", "Publish genesis commitment, deposit descriptors or complete address manifest, liabilities and live verifier", "Enable mainnet trading only after independent reconciliation and operational review" ] }, "slots": { "genesis_txid": "", "genesis_block_height": null, "genesis_root": "", "reserve_descriptor_commitment": "", "deposit_manifest_url": "", "initial_virtual_btc_reserve_sats": null, "minimum_buy_sats": null, "creator_payout_address": "", "latest_anchor_txid": "", "latest_registry_root": "", "latest_registry_sequence": null, "post_curve_market_specification": "" }, "glossary": { "anchor": "Bitcoin transaction carrying a commitment to a published registry root", "grain": "One millionth of a p/btc registry unit", "outpoint": "A transaction ID and output index identifying one Bitcoin UTXO", "PSBT": "Partially Signed Bitcoin Transaction used for controlled payout signing", "registry": "Published off-chain ownership and curve event ledger", "reserve": "Operator-controlled BTC UTXOs net of disclosed liabilities", "virtual reserve": "Accounting input to the price formula; not BTC held in a wallet" } }