GnB · hard fork of Bloch · proof-of-work v0.1

Proof-of-work that has to happen in order.

GnB-SMH, the Gödel and Bell Sequential Memory-Hard proof-of-work, chains 2²⁰ SHAKE-256 calls over a 64 MiB scratchpad for every attempt. A quantum miner running Grover's algorithm gains a small constant factor at consensus difficulty, instead of a square-root speedup that grows with difficulty.

See how it works Status and open problems

64 MiBscratchpad written and read per attempt

2²⁰SHAKE-256 calls in one dependent chain

1.2–12×quantum speedup cap per K+1, assumed hardware¹

30 sblock interval, ASERT difficulty

¹ At consensus difficulty, under the hardware assumptions in Quantum. Plain SHAKE-256 hashcash under the same assumptions: 625,000× to 6.25 million×.

Gödel and Bell

Named for two impossibility results: Gödel's incompleteness theorems and Bell's theorem. GnB-SMH starts from a third, shown in “The No-Trapdoor Wall”: a lattice puzzle that miners can solve cannot also be lattice-hard. In the mark, the n is the “and”.

Why

Why the lattice puzzle left

A proof-of-work has no secret. The puzzle comes from the block header, so the honest miner and the attacker face the same instance with the same information, and the cost of attacking equals the cost of mining.

“The No-Trapdoor Wall” swept the Module-SIS family behind Bloch-SIS-PoW. Every parameter set with at least 100 bits of core-SVP hardness has no short solution at all, and every set that has solutions is easy for lattice reduction. Bloch's network showed the same thing in practice: the k = 4 gate could be forged in about 2¹² trials, and the jump to k = 8 stalled block production at height 213,000.

GnB keeps lattices where a secret exists, in ML-DSA-65 signatures. The work moves to sequential depth and memory.

Algorithm

One attempt, four steps

Every inner call hashes exactly 133 bytes, which is one Keccak-f[1600] permutation, and each one waits for the call before it.

Seed

Hash the header and the nonce into the first 128-byte state.

X = SHAKE256(enc("GNB-SMH-v1/seed")
    || u8(19) || enc(header)
    || u64le(nonce), 128)

02
Fill 2¹⁹ steps
Write the 64 MiB scratchpad in order. Each block is the hash of the one before.
```
for i in 0 .. N-1:
  V[i] = X
  X = SHAKE256(X || u32le(i)
               || 0x01, 128)
```
03
Mix 2¹⁹ steps
Read blocks back at addresses chosen by the running state, so the order is unknown until it happens.
```
for i in 0 .. N-1:
  j = u64le(X[0..8]) mod N
  X = SHAKE256((X xor V[j])
      || u32le(i) || 0x02, 128)
```

Final

Hash the last state to 32 bytes and compare it with the target.

out = SHAKE256(
  enc("GNB-SMH-v1/final")
  || X, 32)
valid = out < target

N = 2¹⁹ blocks of 128 bytes. enc(b) = u32le(len(b)) || b. The header is serialized without the nonce. Valid when the output, read as a big-endian integer, is below the target.

One attempt, slowed down

phase final step 524,288 read j – out c05129a877e99e4f…

Fill lights the cells in order; mix flashes the cells it reads. Illustrative: each cell stands for 1,024 of the 524,288 blocks, and the read order here is a stand-in for the real one. The output shown is the test vector for header “gnb”, nonce 0.

Quantum

Where Grover runs out of time

Grover's algorithm needs a long run of oracle calls, one after another, and it splits across machines no better than dividing the search space (Zalka, 1999). A 30-second block interval limits how many calls fit in one run. GnB-SMH makes each call slow on purpose: its 2¹⁹-step fill is a hash chain that needs 2¹⁹ sequential rounds even on a quantum computer (Chung, Fehr, Huang and Liao, 2021).

speedup ≤ max(1, min(√D, (K+1) · T / τ_it))
τ_it ≥ 2²⁰ · t_q

D: expected attempts per block · T: 30 s block interval · K: GhostDAG-Q anticone parameter · τ_it: time of one Grover iteration (compute and uncompute) · t_q: quantum time of one SHAKE-256 call

Quantum speedup cap per (K+1), log scale

GnB-SMHPlain SHAKE-256 hashcash

Published circuitAmy et al. 2016 layout, 100 ns surface-code cycle

GnB-SMH

1×

Hashcash

625×

Reaction-limitedassumed: AND-depth 24, 1 µs per layer

GnB-SMH

≈1.2×

Hashcash

625,000×

Extremeassumed: AND-depth 24, 0.1 µs per layer

GnB-SMH

≈12×

Hashcash

6.25 million×

The t_q values are assumptions about future fault-tolerant hardware, not measurements. A 10× error moves the cap 10×; it stays independent of difficulty.
Plain hashcash is also bounded by the square root of D, so its time limit only binds at very high difficulty. At equal t_q, the GnB-SMH cap is 2¹⁹ times smaller.
The scratchpad depends on the nonce, so a quantum oracle must hold all 64 MiB in superposition: about 2²⁹ logical qubits.
The cap assumes every block carries consensus difficulty. Private chains with heavier blocks are an open problem, listed under Status.

Fork

GnB is a hard fork of Bloch

GnB starts from a new genesis whose ledger is the Bloch Genesis-3 terminal snapshot, converted at a fixed rate. Every holder keeps their keys and their share; from genesis on, GnB is its own network with its own proof-of-work.

Carried over from Bloch

Every output of the Genesis-3 terminal snapshot (452,726 outputs, 3,810,744,000 BLCH) converted proportionally into 1,000,000 GNB, to the same owner
Keys and wallets: bloch1q… becomes gnb1q… with the same hash
ML-DSA-65 ‖ Falcon-1024 post-quantum signatures
GhostDAG block ordering, exact colouring from genesis
SHAKE-256 as the protocol hash

New in GnB

GnB-SMH is the proof-of-work from genesis
An 8-byte nonce is the only PoW field; the SIS solution vector leaves the header
Its own network ID, chain magic, address prefix and replay protection
ASERT difficulty, 30 s target, anchored at genesis
Hard cap 10,000,000 GNB: 10% carryover, 90% mined, halving every 4 years, no tail emission
A consensus minimum fee, so miners are paid after the subsidy ends

Carryover Bloch Genesis-3 terminal snapshot, height 39,918

Status

Research prototype, not audited

These items stand between the prototype and a mainnet fork.

Heavy-block private chains

Open

An attacker who raises its own difficulty on a private chain escapes the per-block cap. A fork-choice weight cap anchored to finality checkpoints is proposed; its analysis is open.

Early measurement

Open

A quantum miner can stop a Grover run early when a competing block appears (Sattath, 2020). With one to twelve iterations per run the room for this is small, but its effect on GhostDAG-Q ordering is not yet analyzed.

Verification cost

Measured

0.55–0.60 s per attempt, single thread, on a 2.8 GHz cloud vCPU. That shapes initial sync, relay delay and denial-of-service policy.

Memory-hardness proof

To re-check

scrypt's ROMix is proven maximally memory-hard (Alwen et al., 2017). The proof has not been re-checked for this SHAKE-256 instantiation.

External review

Required

An independent cryptographic review comes before any mainnet fork.

Specification

Parameters, v1

Name	Value	Meaning
BLOCK	128 bytes	Chain state and scratchpad block size
LOG2_N	19	N = 2¹⁹ = 524,288 blocks
Memory	64 MiB	N × BLOCK, per attempt
SHAKE-256 calls	1,048,578	1 seed + N fill + N mix + 1 final, all sequential
DS_SEED	GNB-SMH-v1/seed	ASCII domain label
DS_FINAL	GNB-SMH-v1/final	ASCII domain label
Step tags	0x01, 0x02	Fill and mix
Nonce	u64, little-endian	The only PoW field in the header
Target	32 bytes, big-endian	1 ≤ target ≤ 2²⁵⁶ − 1
Work	floor(2²⁵⁶ / target)	Block weight for fork choice

Code

Reference code and test vectors

A normative Python reference and a Rust crate agree byte for byte on all 7 test vectors, including the intermediate states, using independent Keccak implementations.

Python reference

reference/gnb_smh.py

Normative definition, 124 lines
Standard library only
Generates the test vectors with intermediates

Rust crate

gnb-smh · #![forbid(unsafe_code)]

Inner step computed directly on Keccak lanes
Checked against FIPS 202 SHAKE-256
0.55–0.60 s per attempt, single thread

Test vector

LOG2_N  19
header  "gnb"  (ASCII, 3 bytes)
nonce   0
out     c05129a877e99e4fd8f1bd6bd39963a95c9ece39bc5055047db51bfaa4f44bef

Sanity checks at small N, not evidence about v1: 4,000 toy blocks fit a geometric distribution (chi-square p = 0.96), and 20,000 outputs were bit-balanced (chi-square p = 0.95).

References

Sources

Zalka. Grover's quantum searching algorithm is optimal. Physical Review A 60, 1999.
Chung, Fehr, Huang, Liao. On the Compressed-Oracle Technique, and Post-Quantum Security of Proofs of Sequential Work. EUROCRYPT 2021.
Amy, Di Matteo, Gheorghiu, Mosca, Parent, Schanck. Estimating the cost of generic quantum pre-image attacks on SHA-2 and SHA-3. SAC 2016.
Alwen, Chen, Pietrzak, Reyzin, Tessaro. Scrypt is Maximally Memory-Hard. EUROCRYPT 2017.
Sattath. On the insecurity of quantum Bitcoin mining. International Journal of Information Security 19, 2020.
NIST. FIPS 202: SHA-3 Standard. 2015.

Proof-of-work that has to happen in order.

Gödel and Bell

Why the lattice puzzle left

One attempt, four steps

Seed

Fill 219 steps

Mix 219 steps

Final

One attempt, slowed down

Where Grover runs out of time

Quantum speedup cap per (K+1), log scale

GnB is a hard fork of Bloch

Carried over from Bloch

New in GnB

Research prototype, not audited

Heavy-block private chains

Early measurement

Verification cost

Memory-hardness proof

External review

Parameters, v1

Reference code and test vectors

Python reference

Rust crate

Test vector

Sources

Fill 2¹⁹ steps

Mix 2¹⁹ steps