Parano1d ① Proof-native Layer 1 ordered by PoW

[IgnotusNemo]

A technical note on Parano1d was published today on the Cryptography mailing list:
https://www.metzdowd.com/pipermail/cryptography/2026-August/039748.html

[IgnotusNemo]

! Parano1d mainnet launch on August 21 at 16:00 UTC.
Binaries will be available a few hours earlier, giving everyone time to install and start their nodes. Mining will unlock automatically at 16:00 UTC, the genesis timestamp.

Testnet infrastructure has now been reduced to 2 seeds. Some existing nodes may still have the retired seed addresses cached, so their first reconnection or synchronization may take slightly longer during the transition. Fresh nodes will connect normally. Thanks to everyone who stress tested the network. It exposed real P2P liveness issues and they are now fixed before mainnet.

Mainnet parameters
Genesis: August 21, 2026, 16:00 UTC
Block target: 20 seconds
Difficulty adjustment: ASERT, 120-second half-life
Consensus: proof-native state transitions ordered by Poseidon2b PoW
Initial block subsidy: 50 NOID
Finality and reorganization window: 18 blocks
Initial State capacity: 2^24 slots, expanding with network use up to 2^32
Unit: 1 NOID = 1,000,000 μNOID

Since there will be another restart for mainet we dont keep the coins mined on the tesnet right?

Correct. Mainnet is a separate network with a new genesis. Testnet balances and mining rewards have no value on mainnet.

[alt_x]

Fail alert

Performance proposal before release.

As a normal miner/user, I do not think the current version is ready for release.
Chain synchronization and miner synchronization are too slow.

The hashing is too heavy, and the code is not optimized enough for normal users.
SHA-256 should be used as an internal hashing algorithm where it is safe and compatible,
while Poseidon2b should remain for the actual PoW mining so the existing mining difficulty and security are preserved.

If the miner cannot synchronize quickly, create a block template in time, or find blocks before the next block arrives, normal users will simply stop using it.
If released in its current state, most users will ignore it and move on.

The developer has a choice:
make it fast and reliable enough for normal users, or risk all this work being for nothing.

[IgnotusNemo]

Performance proposal before release.

As a normal miner/user, I do not think the current version is ready for release.
Chain synchronization and miner synchronization are too slow.

The hashing is too heavy, and the code is not optimized enough for normal users.
SHA-256 should be used as an internal hashing algorithm where it is safe and compatible,
while Poseidon2b should remain for the actual PoW mining so the existing mining difficulty and security are preserved.

If the miner cannot synchronize quickly, create a block template in time, or find blocks before the next block arrives, normal users will simply stop using it.
If released in its current state, most users will ignore it and move on.

The developer has a choice:
make it fast and reliable enough for normal users, or risk all this work being for nothing.

A clean testnet full node syncs in around 20 seconds. Sync time does not grow the way it does on traditional blockchains. In ten years it should take minutes not days, so I think 20 seconds is a good tradeoff. Btw, as the P2P network grows, more nodes will share sync data making sync faster and more reliable.

Alternative hashes were not overlooked. Earlier builds deliberately used BLAKE3 for FRI Merkle commitments and PoW. I removed it from consensus when recursive verification was completed because the recursive proof must verify the entire hash path. Suggesting SHA-256 now ignores the exact reason BLAKE3 was removed and would make the proof path worse, not better. Poseidon2b is not used only for PoW. It is used for addresses, transactions, Merkle and State commitments, proof transcripts, recursion and block IDs. Replacing it would require rebuilding consensus, the proof system, production matrices and the security model. The delay in your logs is proof construction and verification, not a generic hash loop. Parano1d is not designed to make mining easy. PoW only orders already proof-valid transitions. More independent mining power strengthens that ordering layer. Ordinary users can run wallets and fully verifying nodes, but competitive mining is a separate workload and is not guaranteed on every machine.

I am not going to spend my time debating AI generated protocol redesigns anymore.

[Seikar]

I give up on this block finding:

CPU(s):                      12
  On-line CPU(s) list:       0-11
Vendor ID:                   GenuineIntel
  BIOS Vendor ID:            QEMU
  Model name:                Intel Xeon Processor (SapphireRapids)

INFO mining complete block height=15449 txs=1 user_pages=0 proof_class=B25 prepare_ms=32284

This evening, I tested an EPYC 7313P on the testnet.  It built proof_class B25 in 12.4 to 12.5 seconds.  Arguably an EPYC 7313P is either a medium or high performance processor, depending on exactly what one considers "medium" or "high".

Taking 32.3 seconds is a long time in context.  I guess your setup (perhaps 12 vCPUs running under a QEMU virtual machine) is not fast enough to suit this coin's nonlinearity.

But you already know that.  Just providing the additional datapoint.

[alt_x]

I give up on this block finding:

CPU(s):                      12
  On-line CPU(s) list:       0-11
Vendor ID:                   GenuineIntel
  BIOS Vendor ID:            QEMU
  Model name:                Intel Xeon Processor (SapphireRapids)

INFO mining complete block height=15449 txs=1 user_pages=0 proof_class=B25 prepare_ms=32284

This evening, I tested an EPYC 7313P on the testnet.  It built proof_class B25 in 12.4 to 12.5 seconds.  Arguably an EPYC 7313P is either a medium or high performance processor, depending on exactly what one considers "medium" or "high".

Taking 32.3 seconds is a long time in context.  I guess your setup (perhaps 12 vCPUs running under a QEMU virtual machine) is not fast enough to suit this coin's nonlinearity.

But you already know that.  Just providing the additional datapoint.

AI generated:
32 seconds on a Xeon vs around 12 seconds on an EPYC, with a 15 second block time, is simply an epic fail.

[Tongpu]

Fail alert

Lmao, what a time. Every Indian with free gpt access thinks he can tell real developers what they need to do

AI generated:
32 seconds on a Xeon vs around 12 seconds on an EPYC, with a 15 second block time, is simply an epic fail.

Dude, block target is 20 sec. My EPYC 4464P did B25 in 7.2 sec. Trying to figure out how to start a mining pool: proofs on my side, nonce search on your side. I will charge you a 60% fee, lol.

! Parano1d mainnet launch on August 21 at 16:00 UTC.

Hey Ignotus, big respect. Innovations always take time to be fully appreciated. Im sure it will take a year or two before people realize just how much Paranoid has changed the very concept of what a blockchain can be. Most of us are just silently following you. But we are already here.

[alt_x]

Fail alert

Lmao, what a time. Every Indian with free gpt access thinks he can tell real developers what they need to do

AI generated:
32 seconds on a Xeon vs around 12 seconds on an EPYC, with a 15 second block time, is simply an epic fail.

Dude, block target is 20 sec. My EPYC 4464P did B25 in 7.2 sec. Trying to figure out how to start a mining pool: proofs on my side, nonce search on your side. I will charge you a 60% fee, lol.

! Parano1d mainnet launch on August 21 at 16:00 UTC.

Hey Ignotus, big respect. Innovations always take time to be fully appreciated. Im sure it will take a year or two before people realize just how much Paranoid has changed the very concept of what a blockchain can be. Most of us are just silently following you. But we are already here.

It is clear that the developer has put a lot of work into this project, and judging by the speed of development, it appears to be largely AI-assisted development.

One developer sees things from their own perspective, while users and miners see them from their own perspective.

There is a major conflict between these two viewpoints, and I do not think this issue will be solved until the code starts being developed as a collaborative effort by multiple developers, rather than being driven mainly by the vision of a single developer.

[sillvestters]

Your poseidon2b_cryptanalysis.rs audit is pinned against ePrint 2026/306 (Merz & Rodríguez García), and your stated margin over the NIST Category 1 reference is only 3.27 bits. That same paper is the reason Ethereum just abandoned Poseidon2 for its post-quantum stack — not because it's broken, but because the round-skip attack line is new, still being actively improved, and margins dropped 30-50 bits from one paper in one year. Given that history, why should a 3.27-bit margin, computed against the current best-known attack, be treated as durable rather than as a snapshot that the next cryptanalysis paper could erase? Has the end-to-end resource theorem itself (not just the building-block papers) been reviewed by anyone outside this project?

[IgnotusNemo]

Your poseidon2b_cryptanalysis.rs audit is pinned against ePrint 2026/306 (Merz & Rodríguez García), and your stated margin over the NIST Category 1 reference is only 3.27 bits. That same paper is the reason Ethereum just abandoned Poseidon2 for its post-quantum stack — not because it's broken, but because the round-skip attack line is new, still being actively improved, and margins dropped 30-50 bits from one paper in one year. Given that history, why should a 3.27-bit margin, computed against the current best-known attack, be treated as durable rather than as a snapshot that the next cryptanalysis paper could erase? Has the end-to-end resource theorem itself (not just the building-block papers) been reviewed by anyone outside this project?

Good question. The 3.27 bit figure is not a Poseidon2b margin against that paper. It is the gap between Parano1d's end to end gate depth floor 2^173.273866... and the NIST Category 1 reference 2^170.

The 2026/306 attacks are checked separately. Their main results apply to widths 12, 16, 20 and 24, while Parano1d uses width 4 with the M4 external layer. Appendix A does apply to the feed forward compression mode, but its specialization to GF(2^128), t=4, x^7, RF=8 and RP=58 gives a descriptive classical work projection of about 2^409.87 for that attack model. The paper identifies no attack that reduces this production instance to the Category 1 boundary. The calculation and its limits here: https://github.com/ignotusnemo/parano1d/blob/main/noid_soundness/docs/category-one.md#current-poseidon2b-cryptanalysis

Fixed Poseidon2b security remains an explicit premise of the theorem. I am not claiming safety against unknown future attacks. Nobody can. If new cryptanalysis invalidates that premise, the current Category 1 conclusion no longer follows and the production parameters must change. Ethereum's caution is reasonable, but its current work with Poseidon1 does not make the wide instance attacks applicable to Parano1d's binary width 4 construction. Ethereum's own Poseidon cryptanalysis programme is still active through December 2026.

And no, the complete theorem has not yet had an independent expert review. I would welcome one. So far, the certificate has been independently reproduced and mutation tested, but that is not the same as reviewing the theorem itself. This is stated clearly in the documentation.

[IgnotusNemo]

Parano1d now has an official discussion space on github

https://github.com/ignotusnemo/parano1d/discussions

I spend most of my time there, so questions, reports and technical discussions are much easier for me to follow. I do not plan to open Discord, X, Telegram or any other channel people keep asking for. This Bitcointalk thread will remain for major announcements, while I will be active mainly on github. Welcome home, parano1ds )

[alt_x]

Parano1d now has an official discussion space on github

https://github.com/ignotusnemo/parano1d/discussions

I spend most of my time there, so questions, reports and technical discussions are much easier for me to follow. I do not plan to open Discord, X, Telegram or any other channel people keep asking for. This Bitcointalk thread will remain for major announcements, while I will be active mainly on github. Welcome home, parano1ds )

Dev keeps it simple to control, no social channels, no visibility