$USD
$MILLION
Every output below derives live from C = α*·E·σ·S·p with α* = 0.60, E = 0.83, σ = 0.61, S = 1B fixed. Type any price — the math, charts, and floor status follow.
Protocol health — ℋ = attack cost / value at risk
2.41
HEALTHY — CONSTITUTIONAL FLOOR ℋ ≥ 2.00
Attack cost — C
—
Cost to corrupt a 79-seat decryption quorum at the assumed price
Value at risk — Vsh
—
What a captured quorum could reach — the FHE tier only; the ZK pool is immune
Corruption cost — derivation, live
C = α* · E · σ · S · p
α* — CAPTURE STAKE
0.60
effective threshold, lifetime tail
E — ELIGIBILITY RATIO
0.83
eligible / bonded (30-epoch median)
σ — BONDED RATIO
0.61
target corridor 0.55–0.65
S · p — STAKE VALUE
—
1B supply × your assumed price
Validator economics — at your assumed price
SELF-BOND — Bmin
—
100,000 CELAR minimum (0.01% of supply) — recoverable stake, 21-day unbonding
HARDWARE — CAPEX (SUGGESTED)
$8K–12K
32-core CPU · 128 GB RAM · 2× NVMe · 10 Gbps · HSM/TEE for share containment (optional GPU for coproc duty)
OPERATIONS — PER YEAR
$6K–9K
hosting, bandwidth, monitoring, key-ceremony ops — KMS heartbeat ≥ 95% required
TOTAL FIRST-YEAR SETUP
—
bond + hardware + year-1 ops (bond is ~all of it at higher prices — and it remains your asset)
YEAR-1 STAKING REWARD ON BOND
—
≈ 11.7% nominal APR on 100,000 CELAR (≈ 4.7% real + KMS fees)
OPS BREAK-EVEN PRICE
—
price above which bond rewards alone cover annual operations (mid-range ops)
COMMITTEE PRESENCE AT Bmin
~1 in 60
draws — lottery-like KMS fee income at minimum stake; delegation (self ≥ 5%) scales seats & rewards up to 20×
Hardware and ops figures are planning suggestions pending M2 benchmarks — the spec sizes final requirements there. Consensus-only validators carry no FHE evaluation load (coprocessors are a separate bonded role).
Attack cost vs. value at risk
USD, simulated 30 epochs at your assumption — the gap is the security margin
Attack cost CValue at risk Vsh
ℋ over time
Simulated 30 epochs — dashed line is the constitutional floor ℋ = 2.00
ℋFloor ℋ = 2.00
KMS committee — 100 seats · threshold 79
LIVE SEATS 97 / 100
HEARTBEAT (30-EPOCH) 99.2%
SEATS REDRAWN / EPOCH ~4
NEXT RESHARING 11h 24m
Committee state is protocol-side — it does not vary with your price assumption. Shares refresh every epoch; seats rotate on staggered 25-epoch terms.
Constitutional capture bound — rolling 10-year window
P[CAPTURE] AT α = 0.55
≤ 10⁻⁴
of the 30-epoch-median eligible set — guaranteed
PRICED AT α* =
0.60
materially-probable point used in C
RE-DERIVATION
ANNUAL
mandatory on any change to c, t, term, E
The bound is a lifetime tail over the staggered committee lottery — price changes what capture costs (C above), never how probable it is. Governance cannot weaken it; changes are hard-fork-only.
Security events — simulated
E-0 ✓ Epoch resharing complete — 100/100 shares refreshed, pkG invariant
E-0 ✓ Committee draw: 4 seats rotated via VRF_committee (staggered 25-epoch terms)
E-1 ✓ ℋ re-computed on schedule (Vsh and C republished with derivation)
E-1 ◆ Heartbeat miss: seat #61 (1 epoch) — eviction at 2 consecutive
E-2 ✓ Eligibility ratio E published: 0.83 (30-epoch median 0.82)
E-3 ✓ Preprocessing inventory: 100% of re-encryption quota met