Nocturnal: a small, readable privacy coin

Abstract

Nocturnal is a proof-of-work chain with confidential amounts, sender ambiguity and unlinkable recipients. It deliberately contributes no new cryptography: commitments, range proofs and ring signatures are taken from the monero-oxide crates, which implement Monero's reviewed construction. The contribution is the chain around them — written to be small enough that one reviewer can read all of it, with the reasoning behind each rule written down and the internal security review published in full, including the parts that turned out to be wrong.

This document describes intent and design. The normative rules live in the protocol specification; where the two disagree, the specification and then the code are authoritative.

1. The problem

A transparent ledger publishes every payment forever. Anyone who learns one address learns a balance, a set of counterparties, and — by intersecting timing and amounts — often an identity. Chain analysis is a mature industry precisely because the data is simply sitting there waiting to be read.

Money should not work that way. Cash does not itemise your life to strangers. The technical problem is to build a ledger everyone can verify but nobody can read, and that problem is solved: Monero has run this construction under sustained adversarial pressure for a decade.

So Nocturnal does not attempt a cryptographic contribution. It asks a narrower question: how small and how legible can the surrounding chain be, if the cryptography is treated as a dependency rather than an achievement?

2. Design

2.1 Confidential amounts

Every output carries a Pedersen commitment C = xG + aH rather than a plaintext amount. Commitments are additively homomorphic, so a verifier can confirm that inputs equal outputs plus fee without learning any individual value. Each output additionally carries an aggregated Bulletproofs+ range proof establishing that the amount lies in [0, 2^64) — without which a negative amount could mint supply from nothing.

2.2 Sender ambiguity

Inputs are signed with CLSAG ring signatures over exactly sixteen members. The signature proves the signer owns one of the sixteen without revealing which. A key image, deterministic in the spent key, prevents double spends: spend the same output twice and the same image appears twice, and the second is rejected.

The ring size is fixed rather than a floor, and that distinction matters. A variable ring size is itself a fingerprint: the count partitions users by whichever wallet, version or setting produced it, so a user who picks an unusually large ring becomes less private, not more. Uniformity is the property being defended.

2.3 Unlinkable recipients

Each output is paid to a one-time key derived from the recipient's address and a per-transaction secret, so two payments to the same person share no on-chain identifier. Subaddresses let a single wallet hand out unlimited distinct receiving addresses under one view key, so a merchant can publish a fresh address per customer without managing more keys.

2.4 Proof of work

RandomX — the same function Monero uses — chosen because it is designed to run well on general purpose CPUs and poorly on specialised hardware. This is a distribution argument rather than a security one: a chain that ordinary machines can mine spreads issuance wider than one that requires a fabrication plant.

3. Consensus

Blocks target 120 seconds. Difficulty retargets over a windowed average with a lag, outlier trimming at both ends, and a per-step clamp — three independent defences, because an unbounded retarget compounds after a burst of fast blocks and can leave the chain unmineable.

Fork choice is cumulative difficulty, not height. This matters more than it sounds. An earlier version advertised chain height in its gossip messages while consensus compared work, so a peer holding a shorter but heavier branch had no way to say anything the network would act on. That is a persistent chain split with no attacker involved. It was found and fixed before launch, and it is the kind of defect that only shows up when someone writes down what each layer actually believes.

Coinbase outputs mature for sixty blocks before they can be spent — including as ring decoys, since ring signatures hide which member is real — so a reorg cannot invalidate an already-spent fresh coinbase.

4. Economics

Supply approaches 1,000,000 NOCT asymptotically along a smooth emission curve, followed by a 0.03 NOCT tail emission that never terminates. A permanent tail is deliberate: a chain whose security budget falls to zero must rely entirely on transaction fees, and no proof-of-work chain has yet demonstrated that this holds in practice.

Block rewards are consequently sub-NOCT from the start — roughly 0.95 NOCT at genesis, decaying from there. Simulated across the entire smooth phase, emission reaches 96.85% of the supply parameter after about 3.6 million blocks.

4.1 The premine, stated plainly

The planned mainnet genesis block mints 500,000 NOCT to the founder — 50% of the supply parameter. This is the most consequential economic decision in the project and the one every reader should interrogate hardest.

The case against. Monero has no premine, and that fact underwrites a great deal of its credibility. A 50% allocation means one party holds as much as every future miner combined, forever. It is the single largest concentration risk here, it invites precisely the criticism that sinks projects, and no amount of technical care offsets it if you consider the distribution illegitimate. A reader who stops at this paragraph and walks away is behaving rationally.

The case for. It is disclosed everywhere — this document, the front page of the website, the README, the specification and the security review — rather than discovered later by someone reading a genesis block. It is a fixed, verifiable, one-time number rather than an ongoing founder's reward or a permanent tax on every block. There is no sale, no allocation round, no private round at a better price, and nothing being offered to anyone. And it is earmarked for work the project genuinely cannot do without — an audit above all, which costs real money and which no volunteer effort substitutes for.

What it is for. The allocation exists to fund the project rather than to enrich its author, and specifically to pay for:

• A professional security audit. The largest single line item and the one the project most needs. An audit of a chain this size is a five-figure engagement, it cannot be done with goodwill, and shipping money software without one would be indefensible.
• Community. Faucets, bounties for people who find real bugs, grants for wallet and tooling work, and paying contributors who are not the founder.
• Marketing and listings. Making the coin findable by the people it is for, and meeting the costs exchanges and aggregators charge.
• Infrastructure. Seed nodes, explorers, build and release machinery — the parts that must keep running whether or not anyone is paying attention.
• Ongoing development and the project's other operating costs.

What that is worth, stated honestly. The paragraph above is a stated intention, not an enforceable commitment, and you should read it as exactly that. Today the allocation sits in a single wallet controlled by one person. Nothing on-chain compels it to be spent this way, no schedule releases it gradually, no second signature is required, and no third party can block a transaction. A reader who treats "it is for the community" as a guarantee has misread the situation; a reader who treats it as a claim to be verified later has it right.

What would make it verifiable. Intentions become checkable when they leave the prose and enter the chain. None of the following is in place yet, and each is a fair thing to ask for before extending trust:

• Publishing the premine address so that every movement out of it can be watched by anyone.
• A vesting or time-lock schedule, so the whole balance cannot move at once.
• Multisig control, so no single person — including the founder — can spend it alone.
• Published accounting of what was spent and on what.

Until those exist, the accurate description remains the plain one: half the coin, held by one person, with a stated purpose and no mechanism enforcing it. That is a weaker claim than most projects make, and it is the true one.

On testnet the premine is a tenth of this and its seed phrase is published in the repository, so the mechanism is independently verifiable and the coins are unmistakably worthless.

5. What is not claimed

• No audit. Nineteen internal review passes and one independent model review have found real defects — including an 8.79-second denial of service reachable by any peer, and the fork-choice mismatch described above. Internal review is an argument about the code, not evidence about it, which is why it is published in full rather than summarised.
• No network-layer anonymity. Transactions relay over Dandelion++, which frustrates naive origin tracing. It is not Tor, and an adversary who can observe the whole network is not defeated by it.
• Clock dependence. One validity rule — the future-timestamp bound — depends on the validating node's wall clock rather than on chain data. This is deliberate and matches both Bitcoin and Monero: the alternative makes recovery from a long network outage impossible.
• Uniform decoy selection. Ring members are drawn uniformly rather than from a distribution calibrated to real spending behaviour. This is weaker than Monero's gamma selection and is a known, documented gap.

6. Status, and what has to happen next

A public testnet is running. Mainnet parameters — genesis timestamp, address tags, the RandomX seed schedule — are still placeholders.

• A long and genuinely adversarial testnet
• A professional third-party audit, which has not been commissioned
• Gamma-calibrated decoy selection
• A mechanism binding the premine to its stated purpose — a published address, vesting, multisig, and spending accounts. The intention is now on the record; nothing yet enforces it.

Until those are done, Nocturnal is a research chain with a working implementation. It is not money, and nothing here is an offer or investment advice. It is published now so that it can be read, disagreed with, and broken by people who are not its author — which is the only process that has ever produced trustworthy money software.