Glossary
Certificate, fold, skip, deposit, sequencer, forced path. Several of these mean something narrower here than elsewhere, and a couple name events most chains have no word for.
The vocabulary this protocol uses, in the sense it uses it. Several of these words mean something narrower here than they do elsewhere, and two of them — skip and drop — name events most chains have no word for because they have no equivalent.
Certificate#
The only transaction type in Zycord. A certificate carries the state it read and the state it wrote, plus the program that connects them, the signatures authorizing it, a deposit, a TTL, and a bid in each of the two fee markets. Because it carries its own inputs and outputs, checking whether it is valid requires no state at all.
Fold#
The deterministic loop that advances the ledger. It walks a block's certificates in a canonical order — fills first, then every ordinary certificate, then forced certificates — and for each one checks whether its declared reads still hold: if they do it commits the writes, and if they do not it skips. The fold performs comparisons, additions and writes on a hot key-value working set — no code execution, no signature verification, no re-execution, and no elliptic-curve arithmetic. It is the only stage of the system that does not parallelize.
Skip#
What happens to a certificate whose declared reads no longer hold, whose deltas would leave the 256-bit range, or which would write under a spent address. Nothing is written, a fixed skip fee of 1,000,000 drops (0.01 ZCD) is burned from its deposit and pays nobody, the rest of the deposit is returned, and the block remains valid. Whoever named the deposit pays: the author of an ordinary certificate, who chose the reads, or the sequencer of a fill. A user never pays the skip of a fill. Skip is semantics, not failure: inclusion and application are different events, so a block producer can never produce an invalid block by including a stale certificate.
Drop#
A non-charged non-event. A certificate whose deposit cannot be reserved — the deposit cell is already spent, or holds less than the amount the certificate reserves — is dropped: carried in the block, not charged, not marked seen, and free to resubmit against a fresh deposit. Honest users therefore lose nothing to races on their own deposit cell.
Deposit#
The cell that answers for a certificate: a native-balance cell of a user address, the amount reserved from it, and the change slot the remainder returns to. No certificate exists without one, and the deposit cell always carries a signature. Skipping must not be free, or the mempool drowns; the deposit is what gives every conflict an owner. A fill deposits from its sequencer's persistent balance, which is why the sequencer and not the user pays when a fill skips, and a forced certificate is paid out of its open intent's payment instead. The underwriters and insured certificates of whitepaper v1.0 are gone; this is what replaced them.
Cell#
The value at a slot — an unsigned 256-bit integer stored big-endian in 32 bytes. Zero is absence: a slot never written and a slot written to zero are the same slot. That is a consensus requirement, not a convenience: it keeps the state root a function of the state rather than of the history that produced it.
One-shot address (0x01)#
An address whose signing authority is burned permanently by its first debit. Paying a newly derived one-shot address is the zero-contention fast path, and deriving a fresh one per payment is what makes a payment unlinkable to the next. The cost is that “spend some of it” is not a thing a one-shot address can do — see wallet rule 1.
Persistent address (0x02)#
A reusable address. It can never enter the spent registry, so it has no burn-grief surface at all. Merchants, donation addresses, a sequencer's deposits and mining payouts use one; zycordd --payout refuses anything else.
Spent-address registry#
The permanent consensus set of one-shot addresses whose authority has been burned. Cell values under a spent address may be pruned after the undo horizon, but the registry entry never is — it is what stops the address being resurrected. About 33 bytes per address, forever: the protocol's honest open problem, shared structurally with every nullifier-set design.
Valid vs. applicable#
Two predicates that a conventional chain conflates. Valid is stateless, parallel, and checkable by anyone from the certificate's bytes alone. Applicable is stateful, sequential, and decided only by position in the ledger. Two valid certificates may declare the same input value for the same slot; at most one can be applicable.
Guarded delta#
An access discipline in which a certificate asserts a predicate on a slot — balance ≥ 10 — without reading the value into the computation, and writes a signed delta. Any number of guarded debits and credits to the same slot commute, so a skip occurs only on a real overdraft and not merely because the balance changed. This single discipline covers transfers, supply-capped mints, allowances and vault shares, and it is never gated by a sequencer: a sequenced token still accepts every transfer from anyone.
Pure delta#
A signed delta with no guard. It can never conflict and never skip. Tips, counters, accumulators, reward tallies.
Exact read#
The SLOAD-style discipline: the read returns the slot's value into the computation and pins the certificate to it. Arbitrary logic, conflicts on hot slots, and the domain of sequencers.
Sequencer#
An off-chain service a contract chooses to serialize its exact-read traffic. Every contract's record holds a sequencer key: while it is non-zero, an exact read, an equality guard or a set on that contract's cells needs that key's signature; while it is zero the contract is open, and protected only by its code. The sequencer executes users' intents and publishes the results as fills. It is trusted for liveness, never for safety: it cannot change what an intent does, only when, and a fill built on a lie is skipped at the sequencer's expense. If it stops serving, the forced path remains.
Intent#
What a user signs instead of a certificate to call a sequenced contract: the target and calldata, a parallel budget, a nonce, a window of at most 8 blocks, the sequencer's persistent address, bounds on the result, the payment owed to each sequencer, the one-shot payers that fund it, and change outputs. A bound is a predicate on a cell the call writes — final-at-least, final-at-most, delta-at-least or delta-at-most — and at least one must name a cell the call wrote. The intent is the user's whole authorization, and its payments settle only if the fill applies.
Fill#
The certificate a sequencer publishes for an intent. Its program is the intent, its deposit comes from the sequencer's own persistent balance, and its id is the hash of the intent, so two fills of one intent share an id and only one can be charged. Fills come first in the fold's order, each as soon as every pipeline it is in is ready.
Receipt#
A sequencer's signed answer to an intent, returned in milliseconds, long before a block exists: the intent id, the pipeline seq and the result. It is a pre-confirmation — the sequencer's promise, not the chain's, and final only when the fill applies. Because receipts are signed, two from one key that give one seq to different intents, or one intent different results, are a proof anyone can check from the bytes. Consensus does not punish it; users leave.
Pipeline#
The chain keeps, for every pair of sequencer key and contract, the last seq applied. A fill enters only when that counter stands one below its seq, and the counter advances only when the fill applies, so a sequencer's fills commit in the order it signed them, whatever order a producer received them in. A skipped fill holds back the fills built behind it until the sequencer rebuilds from the same number.
Fence counter#
A counter in every contract's record. A fill declares the fence counter of the contracts it was built on, and cannot enter if one has moved. It advances when a forced certificate that lands sets one of the contract's cells, and when the contract's sequencer cell is written — so the forced path and a change of sequencer invalidate every fill built over the state they changed, with nobody charged. A read or a delta does not move it, and neither does a forced certificate that failed. The sequencer rebuilds and loses only latency.
Co-sequencing#
A call that crosses contracts bound to different sequencers lands as one fill carrying the signature of every sequencer whose exact path it touches, up to 16, each with a seq in its own pipeline and each paid what the intent names for it. How they coordinate is off-chain and free by design; the chain sees one certificate, atomic by construction.
Sequencer directory#
Where a sequencer announces its service: a directory certificate from its persistent address binds its key to a string of 1 to 256 bytes of printable ASCII, typically a URL. The entry lapses 259,200 blocks (about 90 days) after the announcing certificate's TTL unless renewed, and a withdrawal removes it at once. Consensus stores the string and never interprets it — it is discovery, not authorization. A node answers it on /directory.
Forced path#
The slow path that needs no sequencer. A user signs an open intent and relays it to the network; a block producer executes the open intents it chooses against the end-of-block state and appends the results as forced certificates, the last certificates of the block. Inclusion is application: there is no queue, lease, quota or deadline. A block carries at most 16 forced certificates, each with at most 4,000 derivation units of parallel budget (200,000 machine gas), which is why every exit a contract offers must fit in that budget. A forced certificate whose call reverts still lands, as FORCED_FAILED: its payers pay, change returns to the user, and nothing else is written.
Open intent#
An intent with no sequencer named and no co-sequencers, funded by the user's own one-shot payers. It travels in the mempool as an intent, not as a certificate, and its payment covers the forced certificate's fees: the base-fee part is burned and the rest goes to the producer. zcd wallet open-intent signs one, and zcd wallet intent --fallback signs one when the sequencer does not serve the original.
cEVM#
The one virtual machine: a dialect of the Ethereum virtual machine adapted to certificates. Storage is declared rather than discovered, opcodes are added for guards, deltas and setting a contract's sequencer, the opcodes with no referent here are removed, and NUMBER and TIMESTAMP answer from the epoch beacon. Active from Era 1, with a delta-first standard library pre-deployed at known addresses. Solidity and its tooling carry over.
Epoch beacon#
Reserved cells the protocol writes once per epoch: the epoch number, the height of the header that opened it, an entropy word, and from Era 1 that header's time. Programs must not read ambient values like the timestamp or the height directly — that would make execution a function of something other than the declared reads — so they read the beacon like any other slot, ideally with a range guard. Its values are constant for a whole epoch. The entropy word is proof-of-work output and is unfit for high-value lotteries.
Epoch#
2,880 blocks — about a day at 30-second blocks, and from the switch to proof of stake 17,280 slots of 5 seconds, still a day. The unit on which the subsidy steps down, the sequential capacity target moves, and the beacon is refreshed.
TTL#
The height by which a certificate must be committed to be valid. Consensus-bounded at 240 blocks (about two hours), 1,440 blocks from the switch to proof of stake, which is what keeps the seen set prunable. Including a seen or expired certificate makes the block invalid — so a signature is billable at most once, and only at a position its signer accepted by signing.
Sequential and parallel gas#
Fees split into two markets: one for sequential state mutation, which is scarce, and one for parallel verification, which is not. A signature check therefore does not compete in the same auction as a storage write, which is what makes heavy cryptography cheap by design. In both, the base fee is burned and the priority fee pays the producer on certificates that apply, and only those; a skipped certificate's fee is burned in full.
Era#
A stage of the protocol, gated by a height compiled into public releases and, in Era 2, by stake measured on chain within height bounds — never by calendar date or by vote. Era 0, live since block 0: mining, native assets, both fee markets, the subsidy split and the treasury, accruing and sealed. Era 1 at height 80,640 on mainnet, about 4 November 2026, and since height 2,880 on the public testnet: the cEVM, sequencers, intents and fills, the directory and the forced path. Era 2, proof of stake: bonding opens at epoch 182, about 7 April 2027; the ramp starts when active stake holds 10% of supply for 30 epochs, at epoch 273 at the latest; the switch to stake alone follows when the ramp completes. Era S would add confidential payments, only after independent audits, and is not part of the current specification. Eras 2 and S each ship as a release of their own, by hard fork. Bonding is not part of Era 1.
Proof of stake#
The consensus of Era 2, in which the right to produce the next block is drawn by stake instead of sold for hashes, and the block interval falls from 30 to 5 seconds. Everything else stands: every node checks every certificate from its bytes, the fold and both fee markets are unchanged, and an invalid certificate inside a block still makes the block invalid. The computation a miner spent on hashes, a producer spends on verification. It enters by a ramp and a switch, and until the switch blocks are mined. Specified in whitepaper §11.
Stake#
Native coin bonded to block production. BOND moves balance from a persistent address into a stake cell tied to that address, whose key is the key that signs blocks, and UNBOND returns it after an exit delay longer than the undo horizon. A stake becomes active one epoch after it is bonded, so stakes cannot be created and discarded in series. The minimum bond is 1,000 ZCD; one key, one stake. Bonding opens with Era 2, at epoch 182.
Pool and delegation#
A pool is a stake that accepts delegation. DELEGATE points a bond at a pool's key, from a smaller minimum than a producing bond, and the balance never leaves the delegator, who can redirect or unbond it under the same exit delay. A pool's weight in the draw is its own bond plus what is delegated to it, and the fold splits its reward once per epoch between the pool, at the margin it declared, and its delegators, in proportion to stake. A delegator is never slashed: if a pool equivocates, only its own bond is burned. Not a mining pool, which is off-chain and outside consensus.
Slot#
Under proof of stake, a 5-second interval in which one block may be produced, by the producer drawn for it with probability proportional to stake from a seed fixed in the previous epoch. An epoch is 17,280 slots. A slot with no block stays empty and pays nothing, and among valid chains the one that occupies the most slots wins. Elsewhere a slot is a storage location, (address, word), whose value is a cell.
Ramp#
The entry of Era 2: 90 epochs in which every block is still mined and also carries the signature of the stake drawn for its height. The staker takes k/180 of the producer's share, where k starts at 1 and rises by one with each epoch that passes the gate: at least 90% of the epoch's blocks signed, and active stake of at least 10% of supply. A block mined without the signature is valid and pays nobody: its producer's share and its priority fees are burned. The ramp starts when active stake holds 10% of supply for 30 epochs, and at epoch 273 at the latest. Not the 30-day issuance ramp; see issuance.
Switch#
The block at which proof of work ends: the first block of the epoch after the 90th epoch to pass the ramp's gate, at epoch 363, about 5 October 2027, at the latest if the gate never pauses. From it, blocks come in 5-second slots, an epoch is 17,280 slots, and each block pays a sixth of the epoch's rate; the per-block ceilings divide by six and every block count that measures time multiplies by six, so capacity and durations per day stay the same. A block is then final at a depth of 120 blocks, 10 minutes, where proof of work asked 20.
Equivocation#
Two headers signed by one key for one slot: the one fault punished in consensus under proof of stake. Like an invalid certificate, it is a one-message proof anyone can check from the bytes. A report certificate carries the two headers, and the fold burns the signer's own bond, removes its key from the active set and pays the reporter a fraction. Nothing a producer does reaches anyone else's coin: a pool's delegations return to their delegators.
Issuance#
ZCD exists only as block subsidy, and block 0 pays none. The rate starts at 21 ZCD per block and steps down at every epoch boundary by exact integer arithmetic — E(n) = max(tail, E(n−1) − floor(E(n−1) / 1054)) — halving about every two years until it reaches the perpetual tail of 0.33 ZCD per block at epoch 4,376, about year 12. The first 86,400 blocks (30 days) are a ramp: block h pays h/86,400 of the rate block 86,400 pays, and what the ramp withholds, about 907,917 ZCD, is never paid back. From the switch to proof of stake each block pays a sixth of the epoch's rate, so a day pays the same. zcd emission --height N prints the subsidy at any height.
Subsidy split#
Every block subsidy, and never the fees, is split 94 / 3 / 3 by consensus from block 0: 94% to the block's producer after a maturity of two hours (240 blocks, 1,440 under proof of stake), 3% to the founder's persistent address until epoch 1,095 (three years), and 3% to the treasury, which also takes the founder's 3% from then on. During the proof-of-stake ramp the producer's 94% is itself divided between miner and drawn staker. It is a rule applied to every block mined, not an allocation at genesis: there is no premine.
Treasury#
The protocol address's native balance. No key hashes to it, no certificate can debit it, and genesis names no quorum. It is credited 3% of every block subsidy from block 1 and 6% from epoch 1,095. No spending path exists in the protocol: one can only be added by a later upgrade, with signers chosen by the community and not by the founder, and the launch commitment is that it comes no earlier than height 259,200, about 5 January 2027.
Stewardship proposal#
A proposal for community review, not a consensus rule. It suggests how the treasury could be spent in its first three years: five seats with public charters — lead developer, reviewing developer, miner, community, public representative — with 3 of 5 to spend, and 4 of 5, public for 20,160 blocks before it takes effect, to replace a holder, rotate keys, spend the reserve or amend a charter. Budgets are shares of treasury inflow, never fixed sums. Nothing in it binds until the treasury upgrade pins a key set. The text is in the companion document.
RandomX#
The proof-of-work function, optimised for general-purpose CPUs so that ordinary hardware stays competitive; mainnet and the public testnet run randomx-v2. It is a consensus parameter, not a setting: a binary that cannot compute a network's pow_engine refuses to start rather than falling back.
State root#
The commitment to the whole of state at a height. A node recomputes it on start and refuses to run if the stored one disagrees, and it doubles as a production-time differential guard between nodes: two implementations that reach different roots from one block sequence have found a bug in one of them.
Where each term is defined normatively#
This page is a reading aid. The definitions that bind are in the specification and the golden vectors; the reasoning is in the whitepaper, v2.0, and its companion, Launch, Eras and Parameters, which governs issuance, the eras and every parameter value. The implementation's own vocabulary section is in docs/ARCHITECTURE.md.