Solve et Coagula

Solve et Coagula is a collection on Robinhood Chain in which you mine a token in your browser, and every whole unit of that token held in your wallet is an NFT drawn entirely on the chain.

The token is DUST, the dust of projection: an ERC-20 with 18 decimals under a DN404 mirror. One whole unit is a dram; a dram has 64 grains. Every whole dram in a wallet is a Stone, a specimen card that the contract draws anew at every reading, in the colour of its age.

Prague, about the year 1600. Under the castle of Emperor Rudolf II, on Golden Lane, the alchemists labour at the Great Work. Their motto is solve et coagula, dissolve and coagulate. Here the Work turns prima materia into the dust of projection, and a whole dram of dust, held in one hand, coagulates into a Stone. Sell a grain and the Stone dissolves. Take the grain back and a new Stone coagulates, never the same one.

I.1The loop

1. The Work. Your browser hashes. A hash at or below the target earns k grains of dust, k from 1 to 64, declared before hashing. A dram always costs the same number of hashes whatever k you choose.
2. The Stone. When your wallet holds a whole dram, a Stone coagulates by itself. The grains you are missing can be bought in the same transaction: on the Stone Bridge while it is cheaper than the Balance, then at the Balance.
3. The Kunstkammer. Every payment at the Balance, and every royalty, is split at once: 55 to the patrons who paid before you, 20 to the Athanor, 15 to the workshop, 10 to the day's crucible.
4. The Athanor. The furnace buys dust back on the bridge, only below the Balance's price, and burns it.
5. The Projection. Once a day the crucible goes to one ticket drawn at random. Every grain drawn from prima materia that day is one ticket.
6. Ripening. A Stone that stays unbroken passes from nigredo to albedo after a day, to citrinitas after seven, to rubedo after thirty. Time is the only rarity there is.

Nobody owns the game. There is no pause, no withdrawal of the bridge stock, no parameter that can be changed, no upgrade. Nobody put ETH into the pool or the prizes: every ETH that anyone is ever paid comes from buyers.

I.2How to read this codex

Each chapter opens with plain words, then the lore, then the exact rules and numbers as the contracts compute them, then why it is built so, then what can go wrong. Numbers marked as computed come from the published formulas of the contracts and are recalculated by the build of this page; numbers from simulations are marked as such, with the command that reproduces them, and they are a toy model: the sign and the order of magnitude are reliable, the third digit is not.

This is the opening edition for chain 4663. The chapters The Contracts and The Recipe at the end give the addresses and the exact bytes of the Work.

Every whole dram of dust in a wallet is a Stone: an ERC-721 token in the mirror contract, drawn on the chain from one word of data and the time of the reading.

The card: a specimen card on pearl, with crop marks in the corners. Above, LAPIS and the number, and the stage from I to IV; the planetary sign of its metal in gold; at the centre the gem of its cut, shaded facet by facet in the pigment of its stage (lamp black, lead white, orpiment, cinnabar), inside a ring of 64 gold ticks, one for each grain of a dram. At the right the vintage on a scale from 0 to 10 000; below, the four stages as swatches with a gold pointer at the present one, the motto in italic, and the metal, the cut and the dram it coagulated from: EX DRACHMA.

LAPIDES

II.1The rules

• Coagulation. When a transfer lifts your balance across a whole dram, the mirror assigns a Stone number (numbers go round: a dissolved number is later given to a new Stone) and the dust contract writes its word: born (40 bits, the block time), depth (16 bits, the drams drawn from prima materia at that moment, the vintage), seed (32 bits of keccak256 of the number, the owner, the time and the block) and projected (16 bits, zero until a Projection marks it).
• Dissolution. When your balance falls below a whole dram, the last Stone of your list is burned, and its age and its mark are gone. When you cross back, a new Stone coagulates with a new word.
• Moving whole. Transferring the Stone through the mirror, or transferring whole drams of dust between two wallets, carries the Stone with its word: age, vintage and mark. DN404 moves the last numbers of the sender's list.
• The stage is the age, now minus born: under 1 day nigredo, from 1 day albedo, from 7 days citrinitas, from 30 days rubedo. It is computed at every reading: the picture changes without any transaction.
• The cosmetics come from the seed and are equally likely: metal = seed mod 7, cut = (seed shifted by 8) mod 6, motto = (seed shifted by 16) mod 16. 7 × 6 × 16 = 672 looks, each in four stages.
• The mark of the Projection. The winner of a day's draw has the first Stone of their list marked: a gold roundel and PROJECTED, DAY with the number of the day, the opening day being 1. At most one Stone a day is marked; the mark vanishes with the Stone.
• Wallets with code (smart contract wallets, delegated accounts, pools, routers) receive no Stones by default: DN404 skips NFTs for addresses with code, so the bridge holds 500 drams of dust and not 500 Stones. A smart wallet may call setSkipNFT(false) to receive Stones; anyone may call setSkipNFT(true) to save the gas of minting.
• Royalties. ERC-2981, 5 % of the sale price to the dust contract, where the Kunstkammer splits it like a payment at the Balance. Wrapped ETH is unwrapped and split the same way (sweep(WETH), anyone may call it); other tokens go to the workshop. Every transfer through the mirror asks the Limit Break transfer validator (ERC721-C, version 5), fixed at deployment. Moving whole drams as dust passes neither the mirror nor the validator and pays no royalty.
• Metadata. The mirror's tokenURI returns data:application/json;base64 with the name Stone No. n, the description, the image as data:image/svg+xml;base64 and the attributes Stage, Metal, Cut, Motto, Vintage, Age (days) and Projection. No IPFS, no server: the Leaf contract draws 3 905 to 4 889 bytes of SVG on every reading, at most 821 040 gas of a free call.
• Gas. Minting a Stone costs about 35 000 gas in all, about 22 000 of it for its word (about 5 000 on a reused number). One transaction may use at most 32 000 000 gas on this chain, so the site takes at most 500 drams in one purchase.

II.2Why time, not luck

On this chain a random trait would cost only gas to reroll: send a grain away and back, about 180 000 gas, 0.024 USD at 0.05 gwei and 2 700 USD per ETH; a trait with a 1 % chance would cost about 2.43 USD of rerolls, and the rare would crowd out the common as holders kept the rare and rerolled the rest. Time cannot be bought with gas: an old Stone can only be bought from its holder, whole, and that gives Stones a reason to trade above their dram, which is where royalties come from. With thresholds of 1, 7, 30 days the first cohort ripens in waves: 98 % whiten on day two, 85 % yellow by day ten, 84 % redden by day 35 (the FUNI data, had it ripened).

II.3What can go wrong

• Selling a single grain below a whole dram dissolves your newest Stone with its age and its mark.
• A Stone listed on a marketplace vanishes if the wallet falls below a whole dram; the listing then fails.
• The first Stone of your list, the one a Projection marks, is not necessarily your oldest.
• Marketplaces cache pictures; the contract asks them to refetch (ERC-4906) once a day when someone plays, but a cached card may show yesterday's stage for a while.
• Whether marketplaces on this chain enforce the 5 % royalty is not verified; the validator is in place.
• Smart wallets and delegated accounts get no Stones until they call setSkipNFT(false).

The Work is proof of work in your browser: find a hash at or below the target and hand it in with WORK; it pays k grains of dust, k from 1 to 64, and k is declared before hashing.

On the bench stands the alembic over its lamp; the flask beside it fills with grains as hashes pass, and when it holds 64 the Stone coagulates. The alchemists called the labour itself opus, the Work, and it was never quick.

III.1The rules

• work(nonce, k): k from 1 to 64, else the call reverts with BadGrain. The message that is hashed is keccak256 of the seed, your address, your count of Works handed in, k and the nonce, laid out exactly as the chapter The Recipe (XVI) describes. It is tied to your address, so a found hash cannot be taken from the mempool; the count changes at every hand-in, so no hash can be handed in twice; the seed is fixed at the opening, so nothing could be mined before it.
• Valid when the hash, read as a number, is at most target(k) = floor((2^256 − 1) ' + '/ W(d)) × 64 / k, integer arithmetic in that order, where d is the number of drams drawn so far, the bridge stock included. Otherwise NoWork, and the call reverts.
• W(d), hashes a dram: 2^22 × 2^(d / 300) up to dram 2 000, then 2^22 × 2^(2000 / 300 + (d − 2000) / 180). In the contract d is in wei of dust and the power of two is computed with a fixed-point exponential, so the last digits differ a little from a float; the site never computes the target, it reads target(k) from the contract.
• Expected hashes for one valid Work: W × k / 64. For one dram: W, at any k. That is why the site can say exactly "this device digs a dram in N minutes": it is W divided by your hash rate.
• The count. Your count of Works rises by one at every valid hand-in, and the next Work must be found for the new count. All your threads search under one count; after sending a hand-in, the site starts on the next count at once and falls back if the transaction fails.
• Prima materia. If the drams drawn plus your k grains would exceed 10 000 drams, the call reverts with Exhausted. When prima materia is drawn to the end, the Work is over; the bridge lives on.
• Tickets. Your k grains are k tickets of the day's Projection.
• The top-up. ETH sent along with the Work completes your current dram after the k grains are credited: missing = one dram minus (your balance mod one dram). The missing grains are bought first on the bridge, while a dram there costs at most the Balance's price with the fee, then at the Balance. If the ETH sent does not cover it, the call reverts with Short; whatever is left is returned. If your balance is already whole after the credit, all of the ETH comes back. The part bought at the Balance makes you a patron and gives tickets like any payment there.
• In passing. Every Work first moves the day's Projection along if a draw is due, and at the end lets the Athanor buy and burn if it is due. That is why the gas of a Work varies.

III.2Which k the site declares

k_time = floor(64 × 60 × rate / W), one success a minute; k_gas = ceil(64 × 5 × gas price × 150 000 / P(d)), a success worth five times its gas at the Balance's price P(d); k = max(k_time, k_gas) clamped to 1 to 64 and never more than what is left of prima materia. For a phone at 2 MH/s and 0.05 gwei that is k = 64 at the opening and k = 18 at dram 2 000; beyond dram 2 500 it falls to 2 or 3, and the gas eats a fifth of each Work.

III.3Why it is built so

• k in the hash. If k were chosen after seeing the hash, a miner would claim the largest k the hash passes and a dram would cost W / 4.74 hashes on average (the harmonic number H₆₄), a curve 2.2 bits cheaper than the published one, paid to luck instead of work. For the same reason there is no partial credit when a Work fails: that would be choosing k after the fact.
• Two slopes. The first 2 000 drams are the phone window: a phone digs a dram in 7 s at the opening and 3.6 min at the knee. The steeper tail beyond it is the farms' zone and cuts their share: in the simulated hype like prspct's, farms take 1.18 ETH instead of 2.35 on a single slope, while browsers keep 1 162 drams of the first hour if GPUs are late (python3 sim/work.py extremes).
• The counter, not the clock. Difficulty grows only with the drams drawn, by the published curve, never with time. There is no clock to game and the price list on the site is exact.
• Where mining stops paying. A farm pays for electricity: at 3.3e-15 USD per hash (a 450 W card at 3 GH/s, 0.08 USD per kWh), a dram costs as much in power as the floor price near dram 5 339 and as much as ten floors near dram 5 936 (at 2 700 USD per ETH). The drams beyond are left to the Balance.

III.4What can go wrong

• The Work got heavier while you waited. Every Work by anyone deepens the curve. A hash found under W may fail under W' when your transaction is included (NoWork, the gas is lost, about a cent). In the simulation a phone loses 1 to 2 % of its hand-ins while only browsers dig, and 15 % in the first hour if GPUs dig the phone window (python3 sim/grain.py). The miner keeps the lowest hash it has found, which helps.
• GPU farms. One gaming card at 3 GH/s is 1 500 phones. When cards arrive, the phone window closes in minutes. In two earlier launches on this chain the first card came at minute 64 and about minute 70; nothing guarantees it will be late again.
• A top-up near the end. When prima materia is nearly drawn, the part of a top-up that the Balance would sell can cross the last dram, and the whole Work reverts with Exhausted. The site should warn; hand in without a top-up then.
• Short. The price moves between the quote and the inclusion; the site adds a margin of about 2 %, and the contract returns what it does not need, but a big move still reverts with Short.
• Gas. The chain's gas is low today (about 0.05 gwei) and can rise; a Work then costs more than a grain is worth at the floor. The site raises k to keep a Work worth five times its gas.

The Balance sells new dust from prima materia at a posted price that rises with the drams drawn, and every payment there is split by the Kunstkammer, the payer becoming a patron.

The imperial apothecary keeps his scales, the Balance, on the bench: he weighs out fresh dust against ETH at the price on the board, and the board is rewritten a little higher with every dram that leaves the prima materia, by the Work or by his own weighing.

IV.1The rules

• The price of a dram at depth d: P(d) = 0.0004 ETH × 2^(d / 2 048), d the drams drawn so far, the bridge stock included. At the opening (d = 500) that is 0.000474 ETH, 2.37 times the bridge's floor; at the knee 0.000787; for the last dram 0.0118.
• A purchase of a drams from depth d costs the exact integral of the price: 0.0004 × 2 048 / ln 2 × (2^((d + a) / 2 048) − 2^(d / 2 048)) ETH, rounded up and one wei more. Splitting a purchase into smaller ones is never cheaper (a fuzz test checks it).
• weigh(minOut) pays at the Balance only. It computes the dust your ETH buys from the current depth, capped at what is left of prima materia, reverts with TooLittle if that is zero or below minOut, and returns the ETH it does not need.
• buy(minOut) spends all the ETH sent: first on the bridge while a dram there, fee included, costs at most P(d); then at the Balance; it returns what neither could take. The top-up of WORK follows the same route for the missing grains.
• The split. Every payment at the Balance goes through the Kunstkammer: 55 to the patrons before you, 20 to the Athanor, 15 to the workshop, 10 to today's crucible. Your patronage grows by the ETH you paid; you do not earn from your own payment. You receive one ticket of the day per grain bought.
• Closed when prima materia is drawn: after dram 10 000 the Balance sells nothing.

IV.2Why it is built so

• Above the floor, always. The Balance starts at twice the floor (0.0004 against 0.0001995 ETH) and only rises, so dust from the Balance can never drain the bridge's ETH at the floor.
• A ceiling for the hype. While the Balance is open, nobody pays much more than P(d) plus one per cent for long: BUY and the top-up route to the Balance as soon as the bridge is dearer, and anyone can do the same by hand. The Balance curve is the ceiling of the price during the hype; the Work curve decides how fast that ceiling rises.
• Doubling every 2 048. Doubling every 1 024 almost never sells (patrons would pay for patronage alone); doubling every 4 096 sells thousands of drams cheaply and, in a strong hype, drains prima materia and closes the Balance in the middle of it (python3 sim/work.py, the Balance table).
• Why a Balance at all. Without it every ETH of the hype goes to whoever mined first. With it, in the model, patrons receive 2.3 to 2.9 ETH and farms take a quarter to a third less (python3 sim/engine.py).

IV.3What can go wrong

• Dear after the hype. The posted price stays while the bridge falls: a day after a simulated hype the Balance is 13.3 times the bridge, after three days 22.6 times (python3 sim/grain.py). WEIGH is for patronage and tickets, not for cheap dust; BUY and WORK route over the bridge first and never overpay by default.
• Patronage is a share of later payments. If nobody pays after you, it returns nothing. See the Kunstkammer.
• The last drams. Near the end a purchase is cut to what is left, and the rest of your ETH is returned.

The Kunstkammer is the till: every ETH paid at the Balance, and every royalty that arrives in ETH, is split four ways at once, and everyone collects what they are owed with COLLECT.

Rudolf II kept his cabinet of curiosities, the Kunstkammer, in the castle: nautilus cups, coral, the horn of a unicorn, globes, automata. Ours is a tall cabinet with four drawers, and every coin that comes in falls through a grille into all four at once.

V.1The rules

• The split in integer arithmetic: patrons = 55 % of the payment, workshop = 15 %, crucible = 10 %, Athanor = the remainder (the rounding wei fall to the Athanor). One payment pays the patrons at most what they have paid in all; the rest of their 55 % goes to the Athanor, and all of it while no patron exists yet. So a few wei paid first cannot take half of the next payment.
• Patronage is the ETH you have paid at the Balance, in wei, forever: it does not expire, it is not transferable, it does not move with the dust. The patrons' share is paid pro rata to patronage through an accumulator (scale 10^24): your pending share = your patronage × accumulator − what was settled for you before. You are settled before your own payment is added, so you never earn from it.
• collect() pays you everything you are owed: patronage and crucibles you have won (the workshop's share and the bridge's ETH fees are sent to its wallet at once). It reverts with Nothing if you are owed nothing. owed(who) shows the amount without a transaction.
• Royalties in ETH arrive through receive() and are split at once (before the opening the contract refuses ETH); wrapped ETH is unwrapped and split by sweep(WETH); any other token sent to the contract goes to the workshop with sweep(token). Dust sent to the contract is burned at the next harvest.

V.2Why it is built so

• Patronage in ETH, not in drams. Counted in drams, the first hour would return ten times as much as later hours; counted in ETH it is gentler to those who come later, and the first hour still returns 255 % of its payment by hour 48 in the model, hours one to six 90 %, hours six to twenty-four 20 %, the second day 0 % (python3 sim/engine.py).
• Royalties into the Kunstkammer, not to the workshop alone. One rule for all ETH that enters the contract, and the patrons' and the Athanor's shares hold the price of the Stone and of the dram.
• No class of work, no prize for the best hash. Both would go to whoever has the most hash power.

V.3What can go wrong

• It is a share of the future. Patronage pays only from payments made after yours. If the hype is over when you pay, it may pay back nothing. Do not pay at the Balance for a return; pay for patronage and tickets knowing that.
• 15 % to the workshop on every payment, forever.
• Wallets that refuse ETH. collect() sends ETH with a plain call; a contract wallet without a receive function makes it revert with SendFailed.

The Stone Bridge is a Uniswap v4 pool of ETH and dust with a fee of one per cent; at the opening the contract lays 500 drams into it as one position from the floor price upward, and no one can ever withdraw that position.

Charles Bridge was simply the Stone Bridge until 1870: sixteen arches over the Vltava, the Old Town Bridge Tower at its head. On the table its stock is drawn as a ladder of prices from the floor up: gold where the bridge has sold, black where the stock still stands.

VI.1The rules

• The pool. currency0 is ETH (the zero address), currency1 is dust, fee 10 000 pips (1 %), tick spacing 200, no hooks. It is created in the constructor at the floor price, in the same transaction as the token, so nobody can create it at another price first.
• The floor. Tick 85 200: 1.0001^85 200 = 5 011.9 dust per ETH, that is 0.0001995 ETH a dram. The decision asked for 0.0002; this is the nearest usable tick, 0.24 % lower.
• The stock. At open() the contract mints 500 drams to itself and lays them as one position on ticks -887 200 to 85 200: in ETH a dram, from the floor to practically infinity. The position holds only dust and no ETH; buyers bring the ETH. Nothing in the code can remove it.
• The price rises as ETH comes in: sqrt(p) = sqrt(floor) + e / L, with L = 500 × sqrt(floor) = 7.06 and e the ETH in the stock; the dust sold on the way is 500 × (1 − sqrt(floor / p)). The whole stock sells only as the price goes to infinity.
• Fees. One per cent of what goes in: ETH on buys, dust on sells. They accrue on the position; harvest(), which anyone may call, sends the ETH to the workshop and burns the dust, then lets the Athanor buy if it is due.
• What the contract does on the bridge. It only buys, for BUY, for the top-up of WORK and for the Athanor, and only while a dram there costs at most the Balance's price with the fee: the swap carries a price limit of sqrt(1.01 × 10^18 × 2^192 / P(d)). Once prima materia is drawn to the end there is no limit. It never sells. You sell on any Uniswap v4 interface or aggregator, with the pool key.
• Other liquidity. Anyone may add liquidity to the same pool at any price; the contract's routing can only gain from it. Other pools may exist too; the game uses only this one.

VI.2Why it is built so

• No ETH put in. The pool had to start from dust alone and take ETH only from buyers; a one-sided concentrated position does exactly that (Clanker tokens on Base launch the same way).
• Five per cent. 500 drams are enough for the first buys and little for a sniper: half the stock costs 0.0998 ETH and quadruples the price. The stock is drams that the Work will never mine; the counter of drams drawn starts at 500 for that reason.
• ETH fees to the workshop, dust fees to ash. The supply melts a little with every sale.

VI.3What can go wrong

• The floor is a floor of the stock, not a promise. At the floor the stock holds no ETH: a seller waits for a buyer. Others may add ETH liquidity below the floor or trade dust in other pools, and then prices below the floor exist.
• The price can fall to the floor and stay there. In the model it does within a day in every scenario and rests there 66 to 70 % of three days; how long the price lives above the floor is decided by demand, not by the mechanics.
• A sniper in the first block can take much of the stock; the size of the stock bounds the harm.
• Routers. A router may route a swap through another pool with a false price (FUNI's warning). Check the pool key; the game's own buys use only this pool.

The Athanor is the buyback: it holds 20 per cent of every payment as ETH and, whenever it has at least 0.001 ETH and the bridge is cheaper than the Balance, fee included, it buys dust on the bridge and burns it.

The athanor was the alchemists' tower furnace, built to hold a steady fire for weeks. On the table ours keeps the ETH waiting inside in batches of 0.001, and the ash below is the dust it has burned.

VII.1The rules

• What it holds. 20 % of every payment and royalty, the rounding wei of every split, and what of the patrons' 55 % a payment cannot pay them (all of it while no patron exists). It holds ETH only.
• When it acts. At the end of every work, buy, weigh and harvest: if it holds at least 0.001 ETH and a dram on the bridge, fee included, costs less than the Balance's price P(d), it spends all it holds on the bridge with the same price limit as any routed buy, and burns the dust it gets (the event Burned). ETH the limit did not let it spend stays for later. It never sells.
• Also to ash: the dust fees of the bridge and any dust sent to the contract, at every harvest.
• How much has burned: the drams drawn minus the total supply (the site shows it as ash).
• At the end. Once prima materia is drawn there is no Balance to compare with, and the Athanor buys at any price.

VII.2Why it is built so

While the Balance sells fresh dust at P(d), buying dearer than that on the bridge would be a gift to whoever is selling there: the Athanor waits instead, and its ETH supports the price on the way down. In a test a first payment of 1 ETH without the limit lifted the bridge 18 times above the Balance's price, and the Athanor would have bought at the top. The threshold of 0.001 ETH keeps each buyback worth its gas.

VII.3What can go wrong

• It may wait long. While the bridge is above the Balance the Athanor holds its ETH; the fire is lit but nothing burns.
• It burns in other people's transactions. The buyback runs at the end of someone's work, buy, weigh or harvest, on their gas: a weigh that also coagulates 21 Stones and triggers the Athanor cost 1 108 469 gas in the test, about 0.15 USD.
• It is not a price guarantee. It buys what its ETH buys and no more.

Once a day the crucible, ten per cent of the day's payments at the Balance, is given to one ticket drawn at random, and every grain drawn from prima materia that day, by the Work or at the Balance, is one ticket.

Projection was the alchemists' last act: the powder of the Stone cast upon molten metal in the crucible to turn it into gold. The crucible stands on its tripod at the right of the bench with an hourglass beside it; it glows as the day runs out and flares when the day is drawn.

VIII.1The rules

• The day. 24 hours from the moment of the opening: day = floor((now − opened at) / 1 day). The contract counts the opening day as day 0; the mark on a Stone and this codex count it as day I, the day plus one in Roman numerals.
• Tickets. Every Work adds its k grains under today's day; every purchase at the Balance adds its grains. Entries hold the holder and the running total of grains; consecutive entries of one holder merge. A grain bought on the bridge is not a ticket: it was drawn from prima materia already.
• The crucible. 10 % of every payment at the Balance and of every royalty, under the day it arrives.
• The commit. After a day ends, the first transaction of the game (work, buy, weigh, collect or project, which anyone may call) commits the day to the L1 block 2 numbers ahead, about 24 seconds (the event Committed).
• The reveal. Any transaction after that block and within 256 L1 numbers, about 51 minutes, takes the block's hash: r = keccak256(hash, day, contract) mod the day's grains, and a binary search over the running totals finds the ticket r. Its holder is owed the crucible (COLLECT) and the first Stone of their list gets the day's mark (the event Projected). Marketplaces are told to refetch every card.
• Missed. If no transaction comes within the 256 blocks, the hash is no longer available and the next transaction commits again.
• Empty days. A day with no tickets passes its crucible to the next day; one call passes up to 30 such days.
• In passing. Every entry point of the game moves the draw along before doing its own work; in a quiet day the site calls project() for you when a draw is due.

VIII.2What the model expects

The crucible of the first day is 0.69 to 0.76 ETH. The chances fall by class as 22 / 35 / 43 % for people, GPUs with farms, and buyers at the Balance if GPUs are late, and 0 / 61 / 39 % if GPUs are at the opening. A phone mining the whole first hour with GPUs late digs 209 drams and holds a 3.26 % chance at the first crucible.

VIII.3Why it is built so

• A ticket per grain drawn, not per call: with a ticket per call, farms would spam one-grain Works until the gas equalled the crucible (the first crucible pays the gas of about 74 863 such calls). Not per address: sybils are free.
• Work or Balance, not the Work alone: then farms would hold 62 to 99 % of the tickets on big days and quiet days would have no tickets at all. Not the Balance alone: that is a paid lottery with no free entry; the Work is the free way in.
• Commit and reveal with a block hash. No keeper, no oracle, no operator: the players' own transactions carry the draw.

VIII.4What can go wrong, honestly

• The quiet hour. The hash of the committed block is public once the block has passed, and any transaction reveals. If only one player is active in the window, they can compute the outcome and, if they dislike it, stay silent until the window expires to get a new block. Each such skip costs them 51 minutes without a single transaction in the game, and anyone else's transaction reveals the result. This happens only in quiet hours, when the crucible is small, so no dearer defence is built.
• The randomness. On this chain the block hash is produced by the sequencer, not by Ethereum; the chain's own documentation calls it pseudo-random and not cryptographically secure. Accepted for crucibles well under one ETH.
• No Stone, no mark. A winner who holds no whole dram gets the crucible but no mark; a winner's first Stone is not necessarily their oldest.
• A day nobody plays is drawn only when somebody does; the crucible waits, and empty days pass it on.

The game opens with one call, open(), which anyone may send from the announced time openAt; until then nothing can be mined or bought, and the exact bytes of the Work are not public.

At the hour, the master unbolts the workshop: one turn of the key lights the athanor, uncovers the Balance and lays the stock of dust on the bridge. Before it the flask stands still, the furnace is cold and the drawers are empty.

IX.1The rules

• Deployment at most five minutes before openAt: the deploy script refuses a later opening on the mainnet. The pool is created at deployment, at the floor.
• open(): reverts with NotYet before openAt and with AlreadyOpen after. It takes the seed of the Work as keccak256 of the previous block's hash, the time and the contract's address; records the opening time; sets the counter of drams drawn to 500; mints the stock and lays it on the bridge; pulls the mirror's owner pointer for the marketplaces; emits Opened(seed).
• If someone moved the empty pool before the opening: nobody held dust then, so nobody could have put dust into it. Downward, the price is returned to the floor for free. Upward, at most a hundredth of the stock (5 drams) is sold into whatever ETH was placed on the way, at the floor's price or dearer, and that ETH goes through the Kunstkammer like any payment. If that ETH still holds the price below the floor, the stock waits in the contract (laid() is false) and the next harvest() lays it as soon as the price is back at the floor or above; the game is open meanwhile, and everyone can always collect.
• Before open(): work, buy, weigh and harvest revert with Closed; the contract refuses ETH.
• The phases of the site: teaser (no contracts yet), waiting (deployed, a countdown to openAt and a button that calls open()), open (the game), exhausted (10 000 drams drawn: the Work ends, the Balance closes, the bridge lives on).
• Gas of the opening: 348 297, up to 548 257 if the empty pool had been moved. Deployment: 12 446 173 gas, 0.00064 ETH at 0.0516 gwei.

IX.2Why the recipe waits

A GPU miner needs the exact bytes that are hashed to write a kernel; the clock starts when the layout becomes public, in the verified source, on the site or in this codex. In two earlier launches on this chain the first card arrived at minute 64 and at about minute 70. Each minute of delay in the first hour gives people about 19 drams; after the first hour the phone window is already dug by the browsers themselves. So the repository stays closed, the contract is deployed at most five minutes before the opening, and the source, the site and the opening edition of this codex are published at the opening.

The window chosen for the opening is a weekend between 13:00 and 15:00 UTC (decision R14). The time may be announced in advance; the recipe may not.

IX.3What can go wrong

• The first minutes belong to hash power. If cards are ready at minute five, the phone window is theirs: people dig 33 drams that day in the model instead of 1 302.
• The bytecode is visible from the deployment. The layout can be read from it; five minutes leave little time, not none.
• Anyone may call open(); it is not a privilege, and the site offers the button at openAt.

Every number that governs the game is a constant or a formula of the contracts, and this table lists them with what they mean and where they come from.

Assumptions behind the derived hardware and money figures, all from the simulations: a phone hashes 2 MH/s in a browser, a gaming card 3 GH/s, farms 1.3 TH/s in all, electricity 3.3e-15 USD per hash, ETH at 2 700 USD, gas at 0.05 gwei, an L1 block every 12 seconds. Change them and the derived figures change; the constants and formulas do not.

Nothing here is a promise of value: the dust can be worth nothing, and the code, once deployed, cannot be changed by anyone.

• The price can fall to the floor and stay there. In the model it does so within a day in every scenario. The floor holds no ETH: at the floor a seller waits for a buyer, and others may add liquidity or trade in other pools below it.
• GPU farms and their timing. One card is 1 500 phones. The phone window of 2 000 drams lasts as long as the cards are late; twice on this chain that was about an hour, and it may be minutes. After the window the Work belongs to cards and farms; people come to the Balance and the bridge.
• Gas. About 0.020 USD a Work today; it can rise, and a failed Work costs about as much as a successful one.
• Reverts. NoWork when the Work got heavier while your transaction waited; Exhausted when a top-up near the end of prima materia would cross the last dram; Short when the ETH sent does not cover the top-up; TooLittle when the Balance would sell nothing for your ETH or less than minOut; Closed before the opening.
• The Projection in a quiet hour. A lone active player can see the outcome and let the window expire to redraw, at the cost of 51 minutes without any transaction; the chain's block hash is pseudo-random, produced by the sequencer. Accepted because crucibles then are small.
• Patronage is a share of payments made after yours. It can return nothing.
• The Stone dissolves when you sell a grain below a whole dram, with its age and its mark; a listed Stone vanishes with it.
• Enforced royalties on marketplaces of this chain are not verified.
• Smart wallets receive no Stones until they call setSkipNFT(false).
• No owner means no fixes. The contracts cannot be paused or patched. They have 51 tests on a fork of the mainnet and, at the time of this edition, no independent review.
• The model is a toy. Simulated figures are calibrated on two real launches on this chain; their sign and order of magnitude are reliable, not their third digit; demand is the great unknown.
• The public RPC rate-limits bursts; the site may lag a few seconds behind the chain.

Words of the lore on the left, what they are in the product on the right.

Questions people ask first, answered shortly; the chapters above have the detail.

Do I need to buy anything to play?

No. The Work costs only gas, about 0.020 USD a Work at today's prices. A phone digs a dram in 7 s at the opening and in 3.6 min at dram 2 000; after that the Work belongs to cards and farms, and the cheap way to a Stone is the bridge.

What is k, and who chooses it?

k is how many grains one Work pays, 1 to 64, declared before hashing. The site chooses it so that a Work lands about every minute and is worth at least five times its gas; you can override it. A dram costs the same hashes at any k.

Why did my Work revert?

NoWork: the Work got heavier while your transaction waited. Exhausted: prima materia is drawn, or your top-up would cross the last dram. Short: the ETH sent did not cover the top-up. BadGrain: k outside 1 to 64. Closed: not yet open.

Can someone take my hash from the mempool?

No. The hash is tied to your address; handed in from another address it is just a number.

Can I mine before the opening?

No. The seed of the Work is fixed by the block of the opening, and the exact bytes are published only then.

How do I sell dust?

On any Uniswap v4 interface or aggregator, with the pool key shown on the site; the game itself never sells. Selling below a whole dram dissolves your newest Stone.

Why is the Balance so much dearer than the bridge?

The posted price only rises with the drams drawn; the bridge follows demand and falls after the hype. Pay at the Balance for patronage and tickets, not for cheap dust; BUY and the top-up of WORK go to the bridge first by themselves.

What does patronage pay, and when?

55 % of every later payment at the Balance and of every royalty, pro rata to the ETH you paid; one payment never pays the patrons more than they have paid in all. Collect at any time with COLLECT; nothing expires. If nobody pays after you, nothing comes.

When is the Projection drawn?

After a day ends, the next transaction of the game commits and a later one within 51 minutes reveals. The site shows due, committed, castable or missed, and offers a button that calls project() when a call is needed.

My wallet is a smart wallet and I see no Stones.

Wallets with code skip NFTs by default in DN404. Call setSkipNFT(false) (the site offers Receive Stones); your whole drams then coagulate.

Can anyone pause or change anything?

No. There is no owner function in the game: no pause, no upgrade, no withdrawal, no parameter. owner() exists only for the marketplace's collection page.

Where is the picture stored?

Nowhere: the Leaf contract draws it from the Stone's word and the current time on every reading, as SVG inside the token URI. No IPFS, no server, no external link.

What happens when all 10 000 drams are drawn?

The Work ends and the Balance closes; the bridge lives on, the Athanor keeps buying and burning with what it holds, the Kunstkammer keeps splitting royalties, the Projection keeps drawing the days that have tickets (there will be none new) and passing crucibles on; Stones keep ripening.

Is the floor a guarantee?

No. It is the lowest price at which the bridge stock sells; it holds no ETH, and others may trade below it elsewhere.

Why Roman numerals for the day?

The game writes the days in Roman numerals, counting the opening day as I; the Stone's card writes its mark as PROJECTED, DAY with the same number in digits; the contract's own counter starts at 0.

These are the contracts of Solve et Coagula on chain 4663, as written by the deployment; the game itself is the dust contract, the others draw and read.

The pool key of the Stone Bridge: currency0 = 0x0000000000000000000000000000000000000000 (ETH), currency1 = 0xD5cCf02A38Fa65d843eebEbe6bc3ffC2687c8063, fee = 10000, tickSpacing = 200, hooks = the zero address.

openAt = 1790254200 (unix seconds); deployed at L1 block 26047406. The public RPC is https://rpc.mainnet.chain.robinhood.com.

Verify addresses by reading the chain, not by trusting this page: the dust contract's stone(), leaf() and key() must agree with the table.

A Work is valid when the keccak256 hash of 93 bytes, laid out exactly as follows, read as a 256-bit number, is at most Dust.target(k).

Valid when keccak256(seed ‖ sender ‖ count ‖ k ‖ nonce) ≤ target(k), with target(k) = floor((2^256 − 1) / W(d)) × 64 / k computed by the contract for the current depth d. Read the target from Dust.target(k); do not compute it yourself, the contract's fixed-point exponential differs from a float in the last digits.

message = seed (32) || sender (20) || uint64(count) (8) || uint8(k) (1) || uint256(nonce) (32)
valid   = keccak256(message) <= Dust.target(k)
then    Dust.work(nonce, k) from sender, optionally with ETH to complete the dram

After a valid hand-in the count rises by one and the message changes; a hash for the old count is worthless. The site keeps the lowest hash found for the current count and k and hands in the best.