Assembled off-chain.
Verified in parallel.
Committed in order.
Every large blockchain makes every node re-execute every transaction against a global state. Zycord takes execution off the chain: a payment is built by the wallet, a contract call is executed by the contract's sequencer from the user's signed intent, and either way the result arrives complete with everything it read and wrote. Any machine checks it from the bytes alone, and a single loop commits it — or skips it, and bills whoever deposited for it.
The transaction is a certificate
It does not ask “execute this”. It states “I read this, I wrote that, and here is the proof”. Anyone recomputes and compares.
program over the reads produces exactly the writes, and the deposit covers the worst case. No disk, no history.reads still hold when the certificate reaches its turn in the block?Two verbs, two stages
The entire design is separating these two questions — and answering each in the cheapest place.
Is it valid?
Answered by looking at the certificate alone. Thousands at once, on any machine.
- Strict Ed25519 signatures check out
- Re-execution matches the writes
- The deposit covers the worst case
- Invalid: never enters an honest block
Is it applicable?
Answered at the certificate's position in the block, comparing bytes against the state table.
- Reads still hold → the writes are committed
- Stale read or overflow → skip, the depositor pays a fixed fee
- Deposit unfunded or spent → dropped, nothing charged
- The block stays valid in every case
Four outcomes, and who pays
A problem with a certificate is an outcome, never a reason to reject the block. Every outcome is charged to a party that chose the risk, and one signature is charged at most once.
Applied
Every declared read holds, so the writes land and the fee settles at actual cost: the base fee is burned and the priority fee is paid to the producer.
Skipped
A read no longer holds, or a delta would leave the 256-bit range. Nothing is written. A fixed skip fee of 0.01 ZCD is burned from the deposit and the rest is returned. The id is marked seen, so no producer can include it again.
Dropped
The deposit cell is unfunded or already spent, so there is nothing to charge. The certificate is carried but not charged, and not marked seen.
The user never pays a skip
The depositor chose the reads, so the depositor answers for them. For a fill that is a sequencer: the one that declared itself for the contract whose read failed, or else the one whose deposit the fill names. The user's payment to each sequencer settles only when the fill applies. Failures with nobody to charge — a fill out of pipeline order, a moved fence, a forced certificate whose reads do not hold — make the block invalid instead, because the producer was the one who could have known.
The flow, from birth to ledger
The wallet builds a payment, or signs an intent
A payment needs no server: the wallet guards a one-shot cell it holds, debits it, marks it spent, credits the payee's fresh address and sends the change to a fresh one of its own. A call to a sequenced contract is a signed intent instead: what to call, bounds on the result, what the sequencer is paid, and the one-shot payers that fund it.
The sequencer executes and confirms
It runs the intent over its own view — the chain tip plus every fill it has already built — answers with a signed receipt in milliseconds, and publishes the result as a fill deposited from its own balance. A call that crosses contracts bound to different sequencers is co-signed by each and lands as one atomic fill.
Every node verifies in parallel
Each certificate is checked from its bytes on arrival, before it is relayed: signatures, re-execution against the declared reads, the deposit. No state, no history, any core, any machine.
The producer orders
A proof-of-work miner picks valid certificates and solves the block; after the switch to proof of stake, the staker drawn for the slot signs it instead. It executes nothing it is given and remembers the ids seen within the TTL window, because including one twice makes the block invalid. At the end of its block it may execute open intents from the forced path.
Sequential fold
Fills first, in pipeline order; then every other certificate by (deposit address, seq, id); then forced certificates by id. The producer chooses none of it. For each certificate: do the declared reads still hold?
State: cells, addresses, typed access
A cell is a 256-bit integer at a slot. Absent cells read as zero. Concurrency is not discovered at runtime: it is declared, slot by slot.
One-shot and persistent addresses
A one-shot address is spent once: the certificate that debits it marks it spent, permanently. Wallets give each incoming payment a fresh one, which is the zero-contention path. A persistent address is reusable — an account — and is where mining rewards belong: a one-shot address burns every reward it holds once it is spent, so the node refuses one as a payout. Contracts have their own address kind, which no key can sign for.
Native assets, no machine
From block 0: TRANSFER of up to 32 moves, ISSUE with a supply cap, MINT guarded by that cap, RETIRE of up to 64 one-shot addresses. A credit to a fresh cell is the tip. Ten thousand tips in one block are ten thousand additions: zero conflicts, no sequencer, no machine.
The machine and its sequencers
Guarded deltas dissolve the contention of payments. What remains is logic that must read exact state to decide what to write — an order book, a market maker — and there the contract chooses its serializer.
The cEVM
A dialect of the Ethereum virtual machine, so Solidity, its compilers and its auditors carry over. Storage is declared: SLOAD and SSTORE are exact, and six new opcodes give the guarded, commutative discipline. NUMBER and TIMESTAMP read the epoch beacon, constant for a day; opcodes with nothing to refer to are removed. Code travels in the certificate. A token, a tip jar and an escrow, written delta-first, are pre-deployed when the machine opens.
Sequenced or open
Every contract's record names a sequencer key. If it is non-zero, the contract's exact path needs that key's signature; if it is zero, anyone may take it and the contract is protected only by its code. Guarded deltas are never gated: a sequenced token still accepts every transfer from anyone. A directory says where each sequencer answers — discovery, not authorization.
Intents, fills, receipts
The intent is the user's whole authorization, valid for a window of at most 8 blocks: the sequencer can change when it runs, never what it does. The fill's id is the intent's hash, so two fills of one intent share an id and only one can be charged. A receipt is a pre-confirmation, the sequencer's promise until the fill applies; two receipts that contradict each other are a proof anyone can check from the bytes, and users leave.
Pipelines, the fence, co-sequencing
The chain keeps the last seq applied for each sequencer and contract, and a fill enters only at the next one, so a pipeline commits in the order its sequencer signed. Each contract also keeps a fence counter: a forced certificate that sets its state, or a change of sequencer, moves it, and every fill built over the bypassed state cannot enter — nobody is charged, and the sequencer rebuilds. A call across sequencers is one fill with every sequencer's signature, atomic by construction.
The forced path: inclusion is application
A contract whose only door is its sequencer would be a jail if the sequencer censored, overcharged or disappeared. Every user has a slow door that needs no one's permission.
Every block folds in three classes, in an order the producer does not choose
The user signs an open intent — an intent with no sequencer named, funded by the user's own one-shot payers — and relays it to the network. The producer, who holds the state at the end of its block, executes the open intents it chooses against that state and appends the results as the block's last certificates. There is no queue, lease, quota or deadline. The intent's payment covers the fees, so the producer earns what a sequencer would.
A failing call still lands
A forced call that reverts, breaks its bounds or runs out of gas enters as FORCED_FAILED: its payers pay, nothing else is written. Whoever relays intents that cannot succeed pays for each one, so they cannot starve a sound one.
It moves the fence
A forced certificate that sets a cell of a contract's state advances that contract's fence counter, so every fill built over the state it bypassed is rebuilt. One that only reads, guards or adds deltas leaves the fence alone, and so does one that fails. The sequencer loses latency, nothing more.
Bounded by construction
At most 16 forced certificates a block, each with at most 4,000 derivation units of parallel budget (200,000 machine gas): at most a third of the genesis parallel ceiling. The rule for contract authors is that a withdrawal fits that budget.
Who does what
No role is required for safety. If every sequencer vanishes, contracts stay alive through their delta methods and the forced path, by which users withdraw and a contract can be bound to a new sequencer.
Wallet
- Does
- Builds payments as certificates; signs intents for contracts
- Sees
- The public state it needs to read
- Trusts
- Nobody
Sequencer
- Does
- Executes intents for its contracts, signs receipts, publishes fills
- Trusted for
- Liveness only. If it lies, its fill is skipped and its own deposit pays
- Captures
- Its own application's order flow, explicitly
Verifying node
- Does
- Checks every certificate from its bytes, relays, syncs
- Needs
- Cores. State only to run the fold
- Cost
- Verification spreads over every core it has; the fold is one loop over memory
Block producer
- Does
- Mines with RandomX, orders valid certificates, executes open intents at the end of its block
- Sees
- Bytes and state, not meaning
- Earns
- 94% of the subsidy, plus the priority fees of what applies
Forced path
- Does
- A permissionless door: an open intent, executed by the producer
- Cost
- The forced price each time, and latency
- Guarantees
- No operator is a prison
The network: two gas markets
A chain that charges for everything in a single auction makes a proof verification compete with a state write. Here each resource has its own price.
Parallel gas
Pays for verification: signatures, bytes, derivation units — heavy proofs, post-quantum schemes.
Sequential gas
Pays for the fold: reads, writes, spent-registry inserts, seen-set inserts. The one loop every node runs in order.
Only what applies pays, and only what applies moves the price
The base fee is burned and the priority fee pays the producer, on certificates that apply and only those; a skipped certificate's fee is burned in full. If a skip paid the producer, whoever assembles the block would profit by arranging other people's failures. Burning inverts it: a skip takes up space and earns nothing. And only applied gas moves the base fees, so filling blocks with self-conflicting certificates cannot price anyone out.
Eras: what runs today, and what comes later
An era is a height compiled into a release, or a condition measured on chain. A block below a gate that carries what the gate enables is invalid; a new era never changes what an earlier block means.
Era 0 — mine and pay
Live since block 0, 7 October 2026. Proof of work under Nakamoto rules, native assets, one-shot and persistent addresses, the two fee markets, the 94/3/3 subsidy split and the treasury, which accrues and which no certificate can debit; a spend path, if any, comes by a later upgrade, not before height 259,200.
Era 1 — the machine
Height 80,640, about 4 November 2026, in the launch binary. The cEVM and its standard library, contract records with sequencer and admin, intents, fills and co-sequencing, the directory, and the forced path.
Era 2 — proof of stake
Bonding opens at epoch 182, about 7 April 2027: stake is bonded, unbonded or delegated to a pool, from a minimum bond of 1,000 ZCD. Once active stake holds 10% of supply for 30 epochs, and at the latest from epoch 273, a ramp of 90 epochs begins: blocks are still mined, each also signed by a staker drawn by stake, who takes k/180 of the producer's share. Its own release, by hard fork.
The switch
The first block of the epoch after the 90th that passes the gate — 90% of its blocks signed, active stake at least 10% of supply. Mining ends; the drawn staker signs each 5-second slot, and an epoch of 17,280 slots pays what a day paid before. A block is final by depth, 120 blocks or 10 minutes. Only equivocation is punished, and never a delegator.
Past full verification
A direction, not a specification. When daily volume nears what an ordinary node verifies, a later era may draw a subset of stakes to verify each certificate instead of every node, while the state and the fold stay one and every certificate stays atomic. Until then every node verifies everything.
The network from above
Four layers that do not overlap: who builds, who verifies, who orders, and the door nobody can close. Each scales with a different resource.
Wallets and sequencers
Ordinary web2: websockets, queues, autoscaling. Wallets build payments themselves; sequencers execute intents and answer in milliseconds. Trusted for liveness, never for safety, and never data custodians — the state is always reconstructible from the chain alone.
Relay and verification
Every node checks every certificate from its bytes before relaying it. Blocks travel as a header plus a list of hashes the receiver mostly already holds; bodies are chain data. A node syncs toward the most verified work, not the greatest claimed height.
Producer and fold
A proof-of-work miner orders certificates and solves the block, or, after the switch to proof of stake, the staker drawn for the slot signs it; every node runs the fold, which compares, adds and writes. The fold's order is fixed by the rules, so the producer's only choice is what to include.
The forced path
Open intents, executed by the producer at the end of its block. Inclusion is application — the mechanism that makes the network survive any operator, including the author.