Building UEP β Universal Economic Protocol.
Verifiable economic state transitions for asynchronous networks.
Earth β Space β Interplanetary. ππ°οΈπ
UEP's first public code is out.
A reproducible reference implementation of the testnet transaction model, plus a digital services marketplace layer.
Apache-2.0 Β· v0.3.1-public-preview
https://t.co/t877xM1n0P
Status: testnet reference implementation, not a live network or production system. Fees unchanged: 0.1% protocol, 3% Marketplace. Module map:
https://t.co/cBEvkt1xb3
Feedback and test reports: [email protected]
UEP v0.5.3 is out (testnet). A major integration release: the protocol is now organized into separate modules for settlement, swaps, relay, disputes, oracles and IoT/M2M, on one reference ledger. No native token, no external dependencies.
https://t.co/442R0TMazk
Also in v0.5.3: the Marketplace persists its full state in signed snapshots, ledger submissions go through a queue with backpressure, and the consensus labs now gate CI. Docs are reorganized by module, with a CONTRIBUTING guide. Versions are now plain numbers.
4/4 Why we read it: UEP signs client spends with Ed25519 (not post-quantum), and our lab replication applies a spend only after a 3-of-4 replica certificate. At n=4 the hard part is delay, not aggregation: DQS assumes partial synchrony; EarthβMars round trips take many minutes.
Post-quantum BFT has a quiet bottleneck: quorum certificates. BLS folds n votes into 48β192 bytes; no known post-quantum scheme stays constant-size. Kniep, Sliwinski & Wattenhofer (Anza, ETH Zurich) sidestep aggregation instead of solving it. 1/4
https://t.co/iezfWU6zgS
3/4 Paper's numbers (good case, hash-based WOTS-TS one-time signatures): each DQS message is 624 B, while BLS certs grow with the signer bitmap. At n=10,000: 12.5 MB per node vs 14.1 MB for BLS. Simulated Alpenglow on ~750 Solana nodes: median finality 130 to 140 ms.
@gakonst@carllerche With a 500 ms tick, one thing that pays off in DST: route every time read, timer and RNG through an injected interface, and lint the real impls out of core code. Otherwise one stray now() call silently breaks seed replay.
For UEP this is a question, not a result: our v0.5.1 domain profiles add a Mars delay window (602 blocks, ~50 min), where no quorum can avoid the remote tail. UEP today is a local in-process testnet reference, not multi-node consensus, so this stays open research.
Paper: Hydrozoan (Yu, Kokoris-Kogias, Sonnino; HKUST-GZ, Mysten Labs, UCL). DAG BFT consensus with two commit paths under f Byzantine + c crash faults on n=3f+c+2p+1 validators: 2 message delays with β€p faults, 3 otherwise, no view changes.
https://t.co/cfJFDRGhkI
Also notable: safety and liveness are machine-checked in Lean 4. The authors audit only definitions and theorem statements (~1k lines per protocol); the proofs were AI-generated and checked by the Lean kernel, not read by humans. A clear trust split for AI-assisted proofs.
@hillelogram Part of the "existing codebase" problem is hidden inputs: wall-clock reads, randomness and network calls buried in business logic. Before you can prove a function correct, it has to be a function. Even a lint banning those reads in core code makes later proofs less hopeless.
@kartikb753@alex_alexiuc Agreed. One more piece: bind the key to the request content too. If the same key comes back with a different amount or payee, reject it rather than replaying the first result. Otherwise a buggy retry can look like success on terms nobody actually approved.
@medismera@elonmusk One layer above DTN that often gets skipped: application deadlines. A bundle can wait in custody, but a contract timer shouldn't silently expire meanwhile. Fixing delay windows ex ante (worst-case round trip plus margin) helps; conjunctions need explicit contact-gap rules.
Limits: a local single-node reference, not a network. Solar conjunctions and contact gaps aren't covered, and versions after v0.4.6 are listed as pending external review (docs/SECURITY-COVERAGE.md). Code: https://t.co/hTPY26st1R
How it's enforced: a CI lint bans Date, timers, fetch, network imports and randomness in transition code, and a "poisoned clock" test run makes those APIs throw mid-transition. The ADR says plainly these are guards, not a sandbox; review is still needed. https://t.co/8uYCv2e3bm
Listings also declare a domain profile: EARTH, MOON or MARS. It adds a fixed delay to counterparty windows: one worst-case round trip plus 25%, computed offline. Mars: max one-way light time 20.06 min over 2026-28 (JPL DE442s) gives 602 blocks of 5 s, about 50 min.