MidwimbleMimbleWimble privacy chain, merge-mined with Midstate, with hash-based recovery if ECC is brokenStatus: testnet. Research code, not audited. Do not put real value on it.Mainnet is planned for 31 October 2026 unless testnet finds something that needs more time. Launch parameters will be posted here before genesis.
Code (GPL-3.0): https://github.com/ciphernom/midwimbleWebsite: https://ciphernom.github.io/midwimble/Browser wallet (testnet): https://ciphernom.github.io/midwimble/wallet/Explorer (testnet): https://mw.cypherpunk.goldI first described this in the Midstate thread (
https://bitcointalk.org/index.php?topic=5586180.0). It needs its own thread now, and some numbers have changed since (see Mining).
What it isMidwimble is a second chain that runs next to Midstate. It takes Midstate's networking and consensus engine (sequential BLAKE3 proof of work, ASERT difficulty, 60 second blocks) and pluribit's MimbleWimble transactions, and changes one thing about non-interactive MimbleWimble: who can spend an output.
- Amounts are hidden. Pedersen commitments on Ristretto255 with aggregated Bulletproof range proofs.
- No addresses on chain. You pay a stealth address (mw1q...). The receiver doesn't need to be online and nothing on chain points back to the address.
- Only the receiver can spend. In most non-interactive MW designs the sender builds the output, knows the blinding factor, and so can spend it. Here every output also carries a one-time owner key that only the receiver can sign for, and a transaction has to prove its owner keys balance, the same way it proves its amounts balance.
- Merge-mined with Midstate. Same proof of work, so one hash counts for both chains.
- Anchored to Midstate. Checkpoints of Midwimble's state go into Midstate, which has no elliptic curves anywhere. The post-quantum recovery plan depends on these anchors.
How the privacy works- Stealth outputs. For each output the sender picks an ephemeral key and does ECDH with your scan key to get a shared secret t. The output's owner key is Ko = H(t)*G + B, where B is your spend key. Only someone holding b can sign for it.
- Encrypted amounts. Value and blinding factor are encrypted to you (XChaCha20-Poly1305) inside the output. A one-byte view tag lets your wallet skip most outputs without trying to decrypt them.
- View keys. A view key (mwview1...) can find and value your incoming outputs but can't spend them. Pool miners use it to check their coinbase payouts.
- Dandelion++ relay. Transactions take a stem path before they're broadcast, so it's harder to tell which node they started from.
What it does
not hide: anyone who paid you knows what they sent. Outputs in the same range-proof group are visibly linked (that's the price of keeping Bulletproof aggregation). And the privacy rests on elliptic curves, so a large enough quantum computer could read amounts published today.
Mining (merged + bonded)Merged mining. A miner puts
H(network magic, midwimble mining hash) into the salt of the last output of a Midstate coinbase. If that Midstate block also meets Midwimble's target, it's a valid Midwimble block. Midstate needs no consensus change. The proof is usually about 220 bytes. The merge miner refuses to hash unless its own rebuild of Midstate's fold matches the Midstate node's mining hash exactly.
Bonds. The usual problem with merged mining is that a large parent-chain miner can attack the child chain at no cost. So every Midwimble block has to be signed under a bond, which is an MDS coin locked on Midstate with a timelocked script that names a mining key. The coin stays yours and unlocks when the lock ends.
| | Mainnet (planned default) | Testnet |
| Minimum bond | 2^37 units (128 gMDS) | 2^24 units (about 0.016 gMDS) |
| Must still be locked for | 30 days (43,200 blocks) | 2 days |
In my October post in the Midstate thread I said 16 gMDS. The launch default is now 128 gMDS.
No bond can carry the chain on its own. Over the last 1,440 blocks (a day), each bond counts at full weight in fork choice for at most 4 blocks once 360 or more bonds are eligible. With fewer bonds they share the day equally. Blocks past a bond's quota are still valid and still pay, but count for 1/1,024 of their work. On top of that, no block counts for more than a quarter above the lowest-work block of the week before it. To outweigh the honest chain you need more bonds than the honest miners have, not just more hashrate.
Midwimble also keeps its own relay of Midstate headers, so a bond has to be proven against the real Midstate chain buried under a day of work. A fake bond means keeping a fake Midstate branch heavier than the real one.
Pool miners don't need a bond. The pool operator holds it (others can co-bond: lock your own MDS naming the pool's mining key, keep the owner key). The Midstate pool at
https://rpc.cypherpunk.gold/pool merge-mines Midwimble now. Give it a Midwimble address and every share also earns Midwimble score, paid in the Midwimble coinbase. With Midstate v5.0.1:
./midstate miner --pool-url stratum+tcp://rpc.cypherpunk.gold:3333 \
--payout-address <your MDS address> \
--midwimble-address <your mw1 address>
A Midwimble block pays at most 31 addresses: anyone with 1/31 of the score is paid exactly, the rest by a draw that gives each their share on average. Without --midwimble-address the pool keeps your Midwimble share.
Join the testnet:git clone https://github.com/ciphernom/midwimble && cd midwimble
python3 scripts/join_testnet.py # follow the chain
python3 scripts/join_testnet.py --mine # mine it too (walks you through the bond)
The script builds from the published parameters in scripts/testnet.json and refuses to run unless your binary produces the published genesis block. Mining needs a synced Midstate node that serves /headers and /utxo_proof (Midstate v5.0.x has both), plus your Midstate wallet for the bond.
Other commands (from the README):
export MIDWIMBLE_PASSWORD=...
midwimble wallet --wallet w.mww create # v1 address + 24 words
midwimble wallet --wallet w.mww balance
midwimble wallet --wallet w.mww send --to <address> --amount 0.25
midwimble bond new --file bond.json
midwimble node --mining-bond bond.json --mine-to <address>
# solo merged mining against your Midstate node
midwimble merge-mine --midstate-rpc 127.0.0.1:8545 --midstate-address <hex> \
--midwimble-address <address> --anchor-store anchors.jsonl
# Midwimble's own pool; the view key never leaves the miner
midwimble pool --address <operator address> --stratum 0.0.0.0:3333 --api 0.0.0.0:8081
MIDWIMBLE_VIEW_KEY="$(midwimble wallet view-key)" \
midwimble pool-mine --pool stratum+tcp://host:3333
Build with
cargo build --release (
--features gpu for the wgpu miner). There are no prebuilt Midwimble binaries yet. The GPU path has only been tested on software Vulkan so far, not real GPU hardware.
Supply- Max supply 1,000,000 coins (8 decimals). The final blocks are trimmed so the total lands on exactly 1,000,000. After that, blocks pay fees only.
- No premine, no dev fund. Genesis mints nothing. The mainnet genesis commits to a Bitcoin block mined after the code freeze and to Midstate's tip, so it can't have been mined in advance.
- Slow start: the reward ramps linearly over the first 43,200 blocks (30 days). Day one pays about 5.75 coins in total.
- Then 0.23932616 per block, halving every 2,100,000 blocks (about 4 years at 60s blocks, same as Bitcoin's era length).
- Coinbase outputs mature after 100 blocks.
- The schedule is defined by its running total, so any node can check a supply claim at any height.
| Era | Blocks | Reward / block | Minted in era | Total at end | ~Years |
| 0 | 1 - 2,099,999 | 0.23932616 (after ramp) | 497,415.37 | 49.74% | 4 |
| 1 | 2,100,000 - 4,199,999 | 0.11966308 | 251,292.47 | 74.87% | 8 |
| 2 | 4,200,000 - 6,299,999 | 0.05983154 | 125,646.23 | 87.44% | 12 |
| 3 | 6,300,000 - 8,399,999 | 0.02991577 | 62,823.12 | 93.72% | 16 |
| 4 | 8,400,000 - 10,499,999 | 0.01495788 | 31,411.55 | 96.86% | 20 |
| 5-22 | ... | halving | ... | | |
| 23 | 48,300,000 - 49,735,953 | 0.00000002 | last units | 100% | ~94.6 |
Last minting block: 49,735,953. The schedule slightly overshoots 1,000,000, so the overshoot (about 0.034 coins) is trimmed off the final blocks.
Post-quantum recoveryMidstate is hash-only. Midwimble can't be, because hiding amounts needs commitments you can add up, and today that means elliptic curves. A discrete-log break would let an attacker forge spends and open commitments to any value.
Midwimble is not post-quantum in normal operation.What it does have is a recovery path:
- Every wallet has a hash-based MSS key (Midstate's Merkle signature scheme) derived from its seed. Its root R is part of your address.
- Every output carries a recovery commitment: rc = H(magic, R, value, blinding, salt), where the salt comes from the stealth shared secret. It reveals nothing on its own, but it fixes the real value and blinding of the output while the curve is still secure, so they can't be changed after a break.
- Checkpoints of the state (UTXO root, kernels, supply...) are anchored into Midstate, either as an ordinary Commit transaction or for free through a merged-mined parent block.
- If the curve is broken, a hard fork picks an anchored checkpoint from before the break. Owners then claim their outputs with an MSS signature plus a proof against that checkpoint. No elliptic-curve key is consulted, each output can be claimed once, and the total can't exceed the checkpoint's supply.
Limits: the recovery epoch is a future hard fork and isn't wired into the node yet (the rules exist as a dormant, tested state machine). Choosing the checkpoint is a social decision. The sender writes rc, and consensus can't check it, so your wallet checks it and flags outputs with a bad one so you can move them. After a break, ownership can be recovered but past privacy can't.
Wallets- CLI: midwimble wallet. Standard BIP39 24-word phrase. Creating a wallet also builds the MSS recovery key (1,024 one-time keys), which takes seconds to a couple of minutes.
- Browser: https://ciphernom.github.io/midwimble/wallet/ The CLI wallet compiled to WebAssembly. Talks to nodes directly over WebRTC with no server of its own. Same phrases, addresses and .mww file format as the CLI, so files move both ways. Seed randomness comes from the browser's crypto.getRandomValues.
- Your own entropy: https://midstate.cash/seedgen turns dice, coins or cards into a standard BIP39 phrase. It generates no randomness itself and can be saved and run offline. Pick 24 words.
The same phrase works for Midstate and Midwimble, but the two derive unrelated keys (different domain tags), so one chain's wallet can't recover the other's.
Warnings- Not audited. The ownership scheme, the merged-mining proof and the recovery commitments all still need a cryptographic review before anyone should trust them.
- Not post-quantum in normal operation (above).
- Anchor verification is SPV-level. Cross-check with your own Midstate node where it matters.
- Testnet coins are worthless and the chain will be thrown away. Testnet bonds are real MDS, but tiny and locked for two days.
- Wallet: no outgoing history yet, and the CLI password prompt echoes (use MIDWIMBLE_PASSWORD).
- Never expose the node's RPC port. Anyone who can reach it can redirect your mining rewards. Use --explorer for a public explorer.
What I want from the testnetDoes bonded mining work for strangers with their own bonds? Does a Midstate pool merge-mining it carry the chain? Does difficulty settle? Do wallets, sync and reorgs hold up on real networks? If something breaks, post here with the node log and the height.
Links-Ciphernom
