Ticoworld

GitHub:

[Ticoworld @_ticoworld]

Last week, I shared what I've been building with QuotaCell and how it could help teams manage spending without giving everyone unrestricted access to the treasury.

Since then, I've been putting that idea to the test.

Remember Alice and Ben? They were allowed to spend 100 tokens between them, even though the treasury held 200.

Alice paid 60. Ben tried to pay 50, but only 40 was left in their shared allowance, so CKB rejected his payment. When he tried 40 instead, it went through.

And that's exactly what I wanted to see.

Both could make payments on their own, without the treasury owner approving every transaction. But neither could go beyond the spending rules the owner had set.

Even with another 100 tokens sitting in the treasury, they couldn't touch them.

It's one thing to describe how something should work. It's another to actually test it and see those rules hold.

There's still work ahead before real teams can use it, but I'm happy with how far the implementation has come.

GitHub:
https://t.co/qtlINxVkxk
I also shared more about the progress on Nervos Talk:
https://t.co/2d0v5RXwxo

@CKBdev @ckba_build @NervosNetwork @NervosCatalyst

[Ticoworld @_ticoworld]

You're running a project. Your team needs to pay people, but you can't be around to approve every transaction.

One teammate needs to pay a designer. Another needs to pay a service provider.

You trust them to do their jobs, but does that mean they should have unrestricted access to the project's treasury?

That's the problem I'm building QuotaCell to solve on CKB.

Imagine your project treasury holds 200 tokens.

You want Alice to handle design payments and Ben to handle operational expenses, but you only want them to spend 100 tokens altogether.

So you give Alice permission to spend up to 70 tokens on her approved recipient, and Ben permission to spend up to 50 on his.

They each have their own signing authority. Neither needs your approval for every permitted transaction.

Here's where it gets interesting.

Alice and Ben aren't spending from separate budgets. They're drawing from the same 100-token allowance.

Alice makes a payment of 60 tokens to her approved designer.

Ben then tries to pay 50 tokens to his approved service provider.

Even though Ben hasn't reached his personal limit, that payment is rejected. There are only 40 tokens left in their shared allowance.

Ben can pay 40, but not 50.

And once they collectively spend that 100, neither can make another delegated payment.

The treasury still holds 100 tokens, but that doesn't mean they're authorized to spend them.

Now imagine someone deposits another 200 tokens into the treasury.

The delegated spending allowance is still exhausted.

Even receiving a refund doesn't restore it. Only the owner can explicitly renew that authority.

That's the distinction I wanted QuotaCell to enforce.

A normal application can display a budget and track payments in a database.

But what happens if someone bypasses that application and constructs a transaction using another tool?

With QuotaCell, the spending restrictions are enforced by a native CKB policy protecting the funds.

Having a valid signing key isn't enough to override those restrictions.

If a transaction exceeds the shared allowance, pays an unauthorized recipient, or breaks the policy, CKB rejects it.

The idea is to let teammates make legitimate payments independently while keeping the owner's treasury protected by rules that don't depend on QuotaCell's server.

And this becomes even more interesting when the people making payments aren't people at all.

Consider two AI agents working for the same project.

One handles approved data purchases. Another handles payments for a different operational service.

Each agent has its own signing key, permitted recipient and spending restrictions. Both operate within one shared allowance.

The agents can independently request and construct payments, but they can't simply exceed the authority granted to them because an AI model decides to.

We've already investigated this architecture alongside existing CKB agent, wallet and transaction-building infrastructure.

Our current native policy can accommodate two independently controlled software signers without changing its core spending rules. Building and testing the agent-facing transaction integration is the next part of that work.

The same foundation also opens possibilities for sponsored team budgets, contributor spending permissions and other applications built around shared financial authority.

I've already implemented QuotaCell's native spending policy and run 89 local CKB verification cases, all producing their expected results.

Those tests cover permitted payments, attempts to exceed the shared allowance, unauthorized state changes, owner administration and recovery.

The current proof uses a synthetic xUDT asset with two delegates and fixed recipient rules. It's not yet deployed publicly or independently audited, and the application itself is still being built.

The goal is to turn this into something real teams can use, while making the underlying native spending policy available for other CKB applications to build around.

Because giving someone access to your treasury and giving them permission to spend a limited amount are two very different things.

I shared the full breakdown on Nervos Talk, including the mechanism, current progress and where QuotaCell is heading.

I'd welcome real-world use cases, integration ideas and technical feedback from other builders as the work continues.

https://t.co/BbZNk32aeH

@CKBdev @NervosCatalyst @NervosNetwork @ckba_build

[ulegend @uledjend]

when you hear industry leaders talking about quantum computing,

it is because bad players are leveraging it to threaten the security of so many blockchain networks.

but @NervosNetwork already prepared from day 1.

CKB is built with cryptographic abstraction which makes it possible to secure and replace security models without breaking the CKB fundamental rules.

[tovarishch.bit @c_hongzhou]

Happy to share some news from @ckba_build CKBA’s DevRel and Ecosystem Support teams: our paper on CCC (https://t.co/ToqoPGVJcN), When EVM Defaults Break: Three SDK Patterns for UTXO-Family Wallets, has been accepted for poster presentation at IEEE International Conference on Distributed Ledger Technologies (ICDLT) 2026!

Through this collaboration, @Hanssen0 (@CKBDevrel) and I (Ecosystem) built on the CCC team’s existing engineering work to distill three reusable design patterns:
• Transaction composition: helping applications handle inputs, change, and fees.
• Unified signing: providing a common interface across different wallet signing methods.
• Reusable wallet connectors: sharing wallet connection and onboarding components across applications.

The conference brings together academia and industry, with organizers from Nova School of Business and Economics, NOVA Information Management School, and the IEEE Portugal Section. It is part of BLOCKCHAIN. PT, a project funded through Portugal’s Recovery and Resilience Plan and the EU’s NextGenerationEU programme.

For us, this is an opportunity to bring CKB’s experience in developer tooling and application development into a broader conversation with researchers and builders.

Thanks to Hanssen and everyone who has contributed to CCC!

[Ticoworld @_ticoworld]

@c_hongzhou @ckba_build Congrats

[Ticoworld @_ticoworld]

We're using one shared Cell for now, with individual limits for each delegate. So yes, concurrent payments can conflict.

The plan is to rebuild against the updated state and check the remaining allowance again. That's part of the next integration tests, so we haven't claimed the retry flow is working yet.

[Ticoworld @_ticoworld]

You're running a project. Your team needs to pay people, but you can't be around to approve every transaction.

One teammate needs to pay a designer. Another needs to pay a service provider.

You trust them to do their jobs, but does that mean they should have unrestricted access to the project's treasury?

That's the problem I'm building QuotaCell to solve on CKB.

Imagine your project treasury holds 200 tokens.

You want Alice to handle design payments and Ben to handle operational expenses, but you only want them to spend 100 tokens altogether.

So you give Alice permission to spend up to 70 tokens on her approved recipient, and Ben permission to spend up to 50 on his.

They each have their own signing authority. Neither needs your approval for every permitted transaction.

Here's where it gets interesting.

Alice and Ben aren't spending from separate budgets. They're drawing from the same 100-token allowance.

Alice makes a payment of 60 tokens to her approved designer.

Ben then tries to pay 50 tokens to his approved service provider.

Even though Ben hasn't reached his personal limit, that payment is rejected. There are only 40 tokens left in their shared allowance.

Ben can pay 40, but not 50.

And once they collectively spend that 100, neither can make another delegated payment.

The treasury still holds 100 tokens, but that doesn't mean they're authorized to spend them.

Now imagine someone deposits another 200 tokens into the treasury.

The delegated spending allowance is still exhausted.

Even receiving a refund doesn't restore it. Only the owner can explicitly renew that authority.

That's the distinction I wanted QuotaCell to enforce.

A normal application can display a budget and track payments in a database.

But what happens if someone bypasses that application and constructs a transaction using another tool?

With QuotaCell, the spending restrictions are enforced by a native CKB policy protecting the funds.

Having a valid signing key isn't enough to override those restrictions.

If a transaction exceeds the shared allowance, pays an unauthorized recipient, or breaks the policy, CKB rejects it.

The idea is to let teammates make legitimate payments independently while keeping the owner's treasury protected by rules that don't depend on QuotaCell's server.

And this becomes even more interesting when the people making payments aren't people at all.

Consider two AI agents working for the same project.

One handles approved data purchases. Another handles payments for a different operational service.

Each agent has its own signing key, permitted recipient and spending restrictions. Both operate within one shared allowance.

The agents can independently request and construct payments, but they can't simply exceed the authority granted to them because an AI model decides to.

We've already investigated this architecture alongside existing CKB agent, wallet and transaction-building infrastructure.

Our current native policy can accommodate two independently controlled software signers without changing its core spending rules. Building and testing the agent-facing transaction integration is the next part of that work.

The same foundation also opens possibilities for sponsored team budgets, contributor spending permissions and other applications built around shared financial authority.

I've already implemented QuotaCell's native spending policy and run 89 local CKB verification cases, all producing their expected results.

Those tests cover permitted payments, attempts to exceed the shared allowance, unauthorized state changes, owner administration and recovery.

The current proof uses a synthetic xUDT asset with two delegates and fixed recipient rules. It's not yet deployed publicly or independently audited, and the application itself is still being built.

The goal is to turn this into something real teams can use, while making the underlying native spending policy available for other CKB applications to build around.

Because giving someone access to your treasury and giving them permission to spend a limited amount are two very different things.

I shared the full breakdown on Nervos Talk, including the mechanism, current progress and where QuotaCell is heading.

I'd welcome real-world use cases, integration ideas and technical feedback from other builders as the work continues.

https://t.co/BbZNk32aeH

@CKBdev @NervosCatalyst @NervosNetwork @ckba_build

[JackyLHH @JackyLHH]

[1/3] Oct 19: gave the CKB Community Fund DAO dashboard a “less is more” makeover.

Wider search, smaller filters, cleaner proposal pages & progress reports, and improved UI/UX.

https://t.co/F39rgcZGSs

[Ticoworld @_ticoworld]

Yes, every protected spend must consume the allowance Cell and recreate its updated state. The treasury lock is tied to the exact policy script hash, including its unique creation ID, so a look-alike Cell can't replace it.

We've tested fake identities and deletion attempts locally too. The full node integration is still ahead.

[Ticoworld @_ticoworld]

🔥

[cellula.id @cellula_id]

Line clear.

Names that get paid. https://t.co/3RFjuAZu2l

[Ticoworld @_ticoworld]

@itpvl4 Good point
QuotaCell reads the actual token amount from the transaction output and checks it against both the individual and shared allowances. We're keeping the transaction rules strict, so anything outside the supported structure gets rejected rather than slipping through.

[neon ↾⇃ @ckbsamurai]

You can swap native CKB for native USDC right now using Perun atomic swaps 🙀

[Jai Chism Photography.bit @jai_chism]

https://t.co/vb896qKiCr

[Ticoworld @_ticoworld]

@apltang @Charlie_Kong_B Thanks Albert, Appreciate it

[telmo.cell @tecmeup]

Live GitHub activity of the CKB ecosystem, drawn in 3D.

Each project is a block that lights up when people work on it. Live, last 24 hours or last 7 days. English, 中文, Português.

https://t.co/gh9HKhMr2u

[FiberDevs @FiberDevs]

🚲 Fiber Dev Log 39 🚲
More groundwork for Fiber v0.10 this cycle, with improvements to database migration, payment settlement, and channel recovery.

Here's what's new:

- v0.10 migration: Database migration code has merged, helping existing channels retain their settlement format as Fiber moves toward v0.10.
- Payment handling: Forwarded payments are now kept separate from local invoices, preventing incorrect settlement updates.
- Channel V2: Work continues on signing and recovery, making it easier to resume interrupted channel operations.
- Hosted LSP: More progress on recovering interrupted updates, handling failed payments, and improving signer reliability.

Full dev log: https://t.co/TSH1tWDOPj

[CKB Dev↾⇃ @CKBdev]

A different kind of building at #CKCon 2026! 🇲🇾🌺
We're in Kuala Lumpur this week! Catching up, sharing ideas, and talking about what's next for CKB.

Great to hear updates and fresh ideas from people across the ecosystem, including @RunningCKB, @ckbsamurai, @JackyLHH, @aaaaaaaalive24, @kashortgirl, @aszepieniec, @teaplusplus11, @BitcoinLightApp, with @ebubedev and @rypto joining remotely. Lots of interesting work and discussions about what's next!

And finally we put the laptops aside and built miniature cities together. 🏙
Turns out we've got some pretty good city builders on the team too! 😄

[Ticoworld @_ticoworld]

Love to see it 🔥

[FiberDevs @FiberDevs]

Good ideas don't stop at the hackathon or the first grant.

We're seeing Fiber builders revisit earlier projects, try new things, and improve their work with feedback from the community:
Twine refined its P2P trading design after security feedback, FiberLatch extended its grant-funded work with a new FiberFlow integration, and FiberSurvivors turned a browser game experiment into a reusable Unity SDK.

⚡ See how these projects are evolving in Pulse 16: https://t.co/tkYaUx8Rtq

[wyltek crypto @wyltek1]

Finally squeezed the esp32s3 HMI into the Blackbox prototype, battling hardware feels nostalgic in the AI era. Loving the increased viewing angle. The new MCU let's me run a $CKB light client on-board with headroom to incorporate stuff like the NFC reader thats also now inside.