Papers
The Rand Protocol is described in print. Six papers are current: the protocol paper in its third draft, the reference-implementation paper written against the node the test network runs, the bridge report, the zUSD paper on the shielded dollar, the standalone security analysis, and the investor summary. Each PDF is the canonical source — download it, cite it, audit it. Where the design has limits, the papers state them rather than omit them.
- WhitepaperSTARKProof of Stake · BFTEVMPost-Quantum
Rand Protocol
Confidential arbitrary computations
Draft 3 · August 2026, updated September 2026 · 73 pages
We present Rand, a proof-of-stake blockchain whose Byzantine Fault Tolerant (BFT) consensus gives fast deterministic finality and whose every transaction is a zero-knowledge proof. Consensus weight comes from bonded stake alone: no computation confers voting power, chooses a leader or decides a fork. What the chain does contain is a great deal of proving performed beside consensus: each wallet produces a STARK for its own transaction, and, once block-level proof aggregation is enabled, bonded aggregators earn RAND by proving recursive STARKs over users' proofs. Validators earn the fees of the blocks they propose; smart-contract semantics are those of the Ethereum Virtual Machine (EVM). The paper explains the zero-knowledge scheme itself — how a computation becomes a table, the table a set of polynomials, and the polynomials a proof of about 1.4 MB per transfer that any validator checks in milliseconds. Rand is a general smart-contract chain that carries no transparent transaction type at all: every computation — a token transfer or an arbitrary contract call — executes confidentially by construction. Users hold shielded RAND, pay gas from it, and execute arbitrary code whose inputs, operands, and intermediate state never appear on-chain, while validators verify a single STARK that the execution was correct. The EVM supplies the semantics that execution is proved against, as an interpreter guest inside the circuit, so existing Solidity bytecode runs unmodified; it is not a transparent execution path alongside the shielded one.
This revision also proposes, as a research direction that is not implemented, Verifiable Prover Attribution (VPA). The running chain does not use it: its wallets prove their own transactions, its leader is chosen round robin, its mempool is not encrypted, and its only bonded proving role is the aggregator register, where the first finalised aggregate to cover a bundle is paid; Part II opens with that status, and its theorems are statements about the proposal, not about the deployed system. The original draft proved that a private transaction's circuit was satisfied but said nothing about how proofs are assigned to provers, under what ordering a prover proves a batch, or how a verifier learns that the entity submitting a proof is the entity that computed it under the conditions the protocol incentivizes. A STARK certifies that the circuit was satisfied; it does not certify the conditions under which it was satisfied. We show this gap opens three concrete attack surfaces — prover–validator collusion, prover-side MEV, and Sybil/unaccountable work — formalize each, and propose to close them with a recomputable assignment beacon, a canonical ordering with a sealed (threshold-encrypted) mempool, and a post-quantum proof-carrying attestation. We accordingly restate the draft's claim that “private transactions eliminate front-running” as a conditional theorem — whose conditions the running chain does not meet, so on that chain content is hidden but ordering is not protected.
We further reconcile three internal inconsistencies in the original security analysis: (i) the contradiction between ~85-bit quantum collision soundness (BHT bound) and the abstract/parameter tables' 128-bit post-quantum claim, fixed in the design by a 384-bit transcript hash plus an explicit per-primitive security-separation theorem (the implementation still uses a 256-bit transcript hash, ≈85 quantum bits); (ii) the unspecified leader-selection VRF, which is Shor-broken if instantiated over an elliptic curve, for which we specify a post-quantum commit–reveal beacon with hash-based cryptographic sortition (not implemented: the running chain rotates leaders round robin and has no VRF at all); and (iii) the under-specified Goldilocks field, for which we mandate a degree-k extension and tie FRI soundness to the query count and grinding budget. This revision also migrates the execution layer from the Solana Virtual Machine to the Ethereum Virtual Machine (EVM), bringing ERC-20 assets and Solidity contracts under the shielded-transaction model, and introduces batched gas settlement: because a per-transaction gas charge in shielded RAND is itself a deanonymizing fingerprint of the EVM call (and hence of the ERC-20 contract touched), gas is committed to public quantization tiers inside the circuit and deducted as a single aggregate charge per batch, so the on-chain footprint is one per-batch total rather than a per-account, per-call deduction. Finally, we give a crypto-agility migration roadmap that ships on SNARKs, upgrades to transparent STARKs, and hardens to full post-quantum security over an ~18-month calendar (~14 months on the parallelized critical path), with each transition gated so that it is a parameter change rather than a consensus fork.
This August 2026 revision extends the shielded model from value transfers to confidential arbitrary computation: we generalize the transfer relation to a universal execution relation over a STARK-proven virtual machine, specify local and delegated GPU proving topologies with their exact confidentiality boundary, and situate the design against the current landscape of proof systems (Groth16, PLONK, Halo2, HyperPlonk, FRI-STARKs), general-purpose zkVMs (RISC Zero, SP1, Cairo/Stwo, Miden, Jolt, OpenVM), zkEVM rollups, and privacy chains (Aztec, Aleo, Miden, Zcash), whose gas-payment and prover-delegation pitfalls directly motivate the RAND shielded-gas and VPA designs. We analyse the prover market that the incentive layer implies, showing that cost per proof is set by utilization rather than energy and that a saturated network's proving demand is met by a few tens of GPUs — so prover decentralization must be justified by liveness and confidentiality rather than by a security budget, since soundness does not depend on the prover set. Finally, we specify how exogenous dollar collateral — USDT and USDC — is imported onto Rand as shielded z-assets by an attested lock-and-mint bridge, which gives the shielded pool a stable unit of account without requiring the issuers to deploy natively — a commercial dependency that would otherwise gate the protocol's payments story on a third party's roadmap. We isolate the property that makes such a bridge sound and is easiest to omit: a guardian quorum attests that a message was published on a watched chain, not that the bridge authored it, so on a permissionless message layer signature validity does not imply authorization and emitter binding is load-bearing. We prove a custody-soundness bound that caps loss at per-chain custody independently of the guardian assumption, show that shielded z-asset supply remains publicly auditable against that custody without opening any note, and identify the bridge as the system's post-quantum frontier: secp256k1 guardian signatures are Shor-broken, so the release path stays classically secure until source chains ship post-quantum precompiles, however the Rand side is hardened.
Principal results- Thm 5.3 — Gas-Payment Privacy Leakage
- Thm 7.9 — Batched Gas Privacy
- Thm 10.6 — Attestation Does Not Imply Authorization
- Thm 10.14 — Custody Soundness
- Thm 10.19 — The Bridge Is the Post-Quantum Frontier
- Thm 13.2 — Attribution Gap
- Thm 15.4 — Front-Running, Corrected and Conditional
- Thm 15.9 — VPA Soundness
- Thm 18.1 — Per-Primitive Quantum Security Separation
- Thm 19.2 — FRI Soundness, Parametric
Draft 3 supersedes Drafts 1 and 2Draft 1 (December 2025) and Draft 2 (the May 2026 VPA revision) are withdrawn. Three of the earlier analysis's own errors are corrected rather than smoothed over: the 128-bit post-quantum claim contradicted the 85-bit quantum collision bound of a 256-bit hash; the leader-selection VRF would have been Shor-broken over an elliptic curve; and plain Goldilocks cannot carry the claimed FRI soundness. The execution layer migrates from the SVM to the EVM and the dual token collapses to RAND alone. The September 2026 updates reconcile the design against the reference full node through chain 15: Rand is stated plainly as proof of stake, the zero-knowledge scheme is written out, and VPA is marked as a proposal the running chain does not use.
- ImplementationzkVM · RISC-VHotStuffChain 15Testnet
Rand Protocol — Reference Implementation
A shielded ledger and a STARK-verified virtual machine, as deployed
Implementation Draft 3 · September 2026 · 46 pages
Settlement systems in conventional finance are confidential by default: account balances and transfer records are visible to the account holder, the institution and, under legal process, a regulator, and to no one else. Public blockchains invert this property. On Ethereum and Solana the global state and the pending-transaction queue are observable by every participant, which exposes institutional order flow to systematic front-running and discloses the counterparties and amounts of every stablecoin transfer. No production protocol currently combines the confidentiality of a bank ledger with the deterministic settlement, transparent verification and post-quantum security of a public chain.
This paper presents Randprotocol, a layer-one blockchain designed to close that gap, as implemented in its reference full node. The native asset, RAND, exists only as notes in a fully shielded pool: a depth-32 Poseidon2 commitment tree and a nullifier set replace accounts, and every transfer is a fixed two-input two-output bundle whose validity is established by a transparent, hash-based STARK proof of the execution of a single pinned RISC-V guest program. The same proof system supports confidential arbitrary computation: RV32IM programs are deployed by content hash and invoked with a proof of execution in place of their inputs, and the chain records eight public output words. Consensus is chained HotStuff with stake-weighted quorums, a three-consecutive-view commit rule and epoch-derived validator sets drawn from a public register; stake is bonded from and withdrawn into the pool. A guardian-attested bridge deposits assets from four external chains as notes. Validator signatures are CRYSTALS-Dilithium2 and note envelopes use ML-KEM-768 with ChaCha20-Poly1305.
We describe the implementation component by component and then develop its formal analysis against the deployed parameters: the bundle and call relations proved by the nine-table zero-knowledge virtual machine, including the taint-accumulator construction that substitutes for an in-circuit assertion; the lookup-bus arguments binding the program digest and the salted input commitment; the FRI soundness of the production profile (80 queries, 20 grinding bits, blowup 8, a degree-2 extension of the Goldilocks field), stated under both the proven proximity-gaps bound and the ethSTARK conjecture; the value-balance and supply-audit identities of the pool; and the safety and liveness of the epoch-aware consensus rules.
The analysis identifies the properties the implementation does not yet provide. Fees, stake weights, deposit amounts at the pool boundary and program identities are public; the current wallet discloses to the queried node the leaf it intends to spend; an 80-query proof occupies approximately 1.3 MB (1.43 MB for the four-slot bundle of chain 14 onward), limiting a 4 MiB block to three shielded transfers (two from chain 14; chain 15 raises the block to 20 MiB); block-level proof aggregation, slashing and EVM and SVM guests were outstanding at the base revision (the guests have since been vendored, though EVM calls are inadmissible under the tier-14 call cap, and three founder-led audit rounds have since been closed; no independent audit has been performed); and the GPU prover has not been executed on hardware. The software is deployed on a test network of 26 validators (chain 17 since 2026-09-29, every validator operated by the founding team) and is not suitable for value-bearing use.
Principal results- Thm 5.8 — Knowledge Soundness, Conditional
- Thm 5.11 — Statistical Zero Knowledge
- Thm 5.12 — FRI Soundness as Instantiated
- Thm 5.14 — Per-Primitive Security of the Deployed System
- Thm 5.17 — Value Balance of the Pool
- Thm 5.22 — Safety
- Thm 5.24 — Liveness after GST
- Thm 5.28 — The Bridge Is Not Post-Quantum
Written against fullnode 26ab1d4, with addenda through 8e64781Every statement about the system refers to the reference node at commit 26ab1d4 (branch main, 2026-09-16): the shielded pool, staking, the bridge as notes and call envelopes, zkVM constraint set 6, the recursion VM, and block-level aggregation, merged but genesis-gated. Two later passes are recorded as marked addenda where the node moved: 2026-09-24 (d050259, v0.5–v0.5.5, chain 14 — the four-slot hidden-asset bundle, the token registry, the hardened bridge) and 2026-09-27 (8e64781, v0.5.6–v0.5.8, chain 15 — the call-header pin and tier cap, the frozen Poseidon2 constants, the aggregate binding).
- BridgeLock-and-MintECDSA · Dilithium2Four Chains
The Rand Bridge
Attested lock-and-mint into a shielded pool, with post-quantum co-signatures
Technical report, draft 1 · September 2026 · 13 pages
Rand is a confidential blockchain whose value lives as commitments in a shielded pool rather than as transparent balances. Its payments story needs a stable asset, and no issuer deploys one natively on a chain without volume. The Rand bridge imports USDT and USDC from Ethereum, BNB Smart Chain, Tron and Solana as a single shielded dollar, zUSD, backed one-for-one by custody on those chains. This report specifies the bridge as built: the 184-byte transfer message and its two signature layers — a secp256k1 guardian quorum for every message and a Dilithium2 co-signature quorum on every mint into Rand, both six-of-eight today; the deposit path that ends in a note the chain itself derives from the attested amount; the withdrawal path in which a burn is bound to its proof and released against per-chain custody counters; the governance surface (guardian rotation with a one-day grace window, explicit listing, a one-way pause that only a post-quantum quorum can lift); and the clock rules a bridged chain imposes on its own consensus.
We state and prove the properties the construction gives — quorum unforgeability, the necessity of emitter binding, custody soundness, supply auditability, and the asymmetric post-quantum bound under which a Shor-capable adversary can forge releases but not mints — and we state, with equal care, what it does not give: the guardians are neither bonded nor slashable, and although six of the eight keys now run on hosts of their own, one hosting account and one operator key still reach all of them. Deployment addresses, message sizes, gas costs and the results of the live rounds are reported.
Principal results- Prop 5.1 — No Redirect
- Thm 5.2 — Custody Soundness
- Thm 8.1 — Quorum Unforgeability
- Thm 8.3 — Attestation Is Not Authorization
- Thm 8.4 — Bridged Supply Auditability
- Thm 8.5 — The Post-Quantum Asymmetry
Companion to the protocol paper's bridge sectionSpecifies the bridge as deployed, in the same notation as the protocol paper's cross-chain section and consistent with it: guardian set 1 (six-of-eight secp256k1) replaced the original five-of-six set on 2026-09-25, and the Dilithium2 set grew from six to eight keys at the chain-15 genesis on 2026-09-26.
- Shielded StablecoinFull ReserveMulti-Chain · Multi-IssuerChain 15
zUSD — A Fully-Reserved Shielded Dollar on Rand
Confidential stablecoin transfers without peg risk, over a multi-chain, multi-issuer locked reserve
September 2026 · supersedes zUSDT (Dec 2025, rev. Aug 2026) · 11 pages
zUSD is fully reserved: each unit is backed one-to-one by a dollar stablecoin held in a custody contract on the chain where that stablecoin is natively issued — USDT and USDC on Ethereum, BNB Smart Chain and Solana, and USDT on Tron, seven backings in all — and is redeemable for any of them on demand. It is deliberately not an algorithmic or fractional stablecoin, so it has no reflexive dependence on the price of any volatile asset and no death-spiral surface of the kind that destroyed Terra's UST. The token lives on Rand, a shielded ledger, so it is a shielded note from the moment it is minted. Every leg is attested, so the guarantee on every unit is min(reserve solvency, guardian threshold integrity), under a dual threshold of six-of-eight ECDSA signatures and six-of-eight Dilithium2 co-signatures.
The reserve invariant S = Σ_b L_b holds with equality and is enforced by construction in one ledger function. The paper gives the per-backing statement of what is guaranteed, including the new risk that pooling two issuers introduces, and sets out the loss-bounding mechanisms the deployment carries: a rolling 24-hour mint cap per backing and a global one, a pause key that can only pause, a forward bound on block time, and release caps on the custody contracts. It is explicit about what is not yet in place: independent guardian operators, a timelocked multi-signature administrator on every custody contract, and a proof of reserves checkable without the project's own explorer.
Principal results- Thm 2.6 — Invariant Preservation
- Cor 2.7 — Redeemability
- Prop 2.8 — Bridge Degradation of Full Reserving
- Cor 2.9 — Per-Backing Guarantees
- Prop 4.1 — Public Verifiability Under Shielding
September 2026 — supersedes zUSDTDescribes the design as deployed on Rand chain 15 and departs from zUSDT in three ways the code now embodies: the token lives on Rand rather than Solana, so there is no transparent form to shield; the reserve spans two issuers as well as several chains, and a holder may redeem to any backing; and every leg is an attested leg, under a dual six-of-eight threshold of ECDSA and Dilithium2 co-signatures. Proposition 2.8 is reproduced unaltered because it is still correct, and Corollary 2.9 records the new risk that pooling two issuers introduces.
- Security AnalysisPost-QuantumAttack Taxonomy
Security Analysis of the Rand Protocol
Post-quantum cryptographic foundations, attack resistance, and formal security guarantees
December 2025, reconciled September 2026 · 13 pages
A security analysis of the Rand protocol with formal proofs under both classical and quantum adversarial models, covering the stake-weighted BFT consensus (Rand is a proof-of-stake chain: no computation confers consensus weight), the STARK-based privacy system, and the CRYSTALS-Dilithium and Kyber post-quantum primitives. It analyses resistance to 51% attacks, long-range attacks, nothing-at-stake, grinding, eclipse and Sybil attacks, front-running, timing attacks and quantum adversaries, with formal bounds and concrete parameters for each.
Under standard lattice hardness assumptions and a per-role assignment of digest sizes — 384-bit where a collision breaks soundness, 256-bit where only preimage resistance is needed — every primitive attains at least 128-bit post-quantum security; without that assignment the same construction attains 85 bits. The system floor is FRI soundness: at least 100 bits under the ethSTARK conjecture and 86 bits under the proven proximity-gaps bound, tunable to a provable 100 at 97 queries and to 128 at a degree-3 extension. Where the reference implementation departs from the design — a 256-bit transcript hash, no validator slashing, round-robin leaders, a plaintext mempool — each result says so.
Principal results- Thm 2.3 — Quantum Collision Resistance
- Thm 3.5 — STARK Quantum Security
- Thm 3.6 — Overall Post-Quantum Security
- Thm 4.4 — HotStuff Safety
- Thm 5.3 — Nullifier Unlinkability
- Thm 6.8 — Front-Running Mitigation, Conditional
- Thm 7.1 — Economic Security Threshold
Subordinate to Part III of the protocol paperA standalone companion to the protocol paper's security part, which is the canonical reconciled treatment and wins any disagreement. The December 2025 analysis carried the three errors Draft 3 corrects; it has since been reconciled against Draft 3 and against the running chain.
- Investor SummarySeed RoundSAFTOctober 2026
Rand Protocol: Investor Summary
Private, programmable settlement with hash-based proofs
October 2026 · 6 pages
Public blockchains publish what businesses must protect: who paid whom, how much, and every order before it fills, so the largest pools of capital stay off them. Rand is a layer-1 chain on which every payment is a shielded note and every transaction a zero-knowledge proof: the network checks that the rule ran without seeing the inputs, and a viewing key lets an auditor read what competitors cannot. Programs in Rust or C run on a RISC-V zkVM proved by a hash-based STARK with no trusted setup, and dollars arrive from four chains as one shielded dollar, zUSD.
The summary sets out the problem, the product and its measured costs, the use cases by readiness, the market with published estimates, the comparison with Aleo, Railgun, Quantus and others, a year of research and the three-week rebuild to a live test network, the token and round prices, the seed round (SAFTs for 110 million RAND, 11% of a one-billion maximum supply, at $0.03), the team and the risks. Not an offer of any security or token.
Principal results- Chain 20 · v0.6.8
- Seed: $0.03 a RAND, $30M FDV
- SAFTs on a 1B max supply
- 28 releases, 7 test chains
Source files
All five papers are written in LaTeX and build with tectonic. The zUSD source is public — it is linked from its entry above, so every statement in it can be checked against the file it came from, beside the superseded zUSDT source in the same repository. The other four papers' sources are not yet published; the PDFs above are their canonical form until they are. Everything else that is public — the node, the wallets, the explorer — lives in the GitHub organization.