A consensus model without energy and without capital dominance. Weight comes from time spent behaving correctly and from a trust graph built out of facts — never from a resource that money can buy.
WEIGHT
min(TBS, 10) × min(TGW, 1) × NDM × COD
TBS
≤ 10
TGW
≤ 1
NDM
×
COD
×
A node's weight is the product of four numbers. Because they multiply rather than add, collapsing any single factor collapses the whole weight — which is what makes each one a barrier rather than a bonus. Every factor below is computed by a pure function that never reads a clock.
The protocol day is derived from block height. That is why every score here is reproducible by any node, and why the calculator further down this page runs the same arithmetic a validator does.
Proof of Work prices identity in hardware. Proof of Stake prices it in capital. Both are purchasable, which is the property PoTB is built to remove.
| MODEL | ANTI-SYBIL BASIS | COST OF MORE INFLUENCE | ENERGY |
|---|---|---|---|
| Proof of Work | Hashrate | Buy more hardware | Enormous |
| Proof of Stake | Capital at stake | Outbid the stake | Negligible |
| Proof of Trusted Behavior | Time, behaviour, trust graph | Only time and honesty | Negligible |
The claim is narrow on purpose: PoTB removes the purchasable resource. It does not claim that domination is impossible, and the limitations further down say so in writing.
Each component raises the cost of an attack. None of them is presented as a proof — the model says so in writing.
ln(1 + d × c) + loyalty(d)The logarithm of uptime × correctness, plus a loyalty term past one year. A freshly minted identity earns none of it, and the score is derived from a protocol day computed from block height — never from a local clock.
SybilRank × dispersionSybilRank over attestations, discounted by temporal dispersion so a farm launched in one window is priced for it, and probed once per epoch by a challenge from a node you have no edge to.
f(ASN spread)A soft multiplier over autonomous-system spread, so a hundred nodes in one datacenter are priced as what they are.
1 / (1 + correlation)Weak statistical signals of common ownership — similar uptime rhythms, nearby registration windows, partial ASN overlap — suppress the joint weight of the whole group rather than each node the cap happens to catch.
min(TBS, 10) × min(TGW, 1) × NDM × CODFinality comes from a committee, not from whoever produced the block. It is redrawn continuously so that capturing it would mean capturing the weight distribution itself.
0
seats
0
Quorum
0
blocks
Partial rotation, per block
10 / 100
Rotation exists to bound network load as much as to resist capture: replacing the entire committee every block would multiply the vote traffic for no additional safety.
Every level is reached by running the client and behaving well. None of them is reached by paying.
Store the chain, validate locally, relay to peers.
Immediately
Drawn by VRF into a trial committee at low weight once TBS clears the floor.
Weeks of operation
Full weight in the formula and a vote in finalisation, with no penalty in history.
TBS + TGW thresholds
Weight calculator
W = min(TBS,10) × min(TGW,1) × NDM × CODConsensus weight
0.000
The real formula, driven live. Every scoring function in the core is pure and clock-free, which is exactly why it can be driven from a slider.
A block reward splits three ways. Only the third involves money, and it deliberately buys a share of that bucket and nothing else.
Block reward split
Plus a ceiling: no member takes more than three times a newcomer's base share. The remainder of the flat bucket's integer division is burned — at most one base unit per member per block, identical on every node.
The operational bond is public evidence that an operator's infrastructure spend is serious. It affects the 15% bucket and does not enter the weight formula at any point. That single boundary is what keeps PoTB from quietly becoming Proof of Stake under another name.
WEIGHT
TBS · TGW · NDM · COD
Operational bond
15% total
A missed vote during a regional outage is noise, not misbehaviour. Penalties are measured against the network median for the same period, so a shared incident does not single out the innocent. Double-signing is the exception — it cannot happen by accident.
| Offence | Penalty |
|---|---|
| A single missed vote | None, while within 2× the network median |
| Systematic misses above the median | −5% TBS per episode |
| Incorrect response, isolated | −10% TBS |
| Incorrect responses, systematic | −20% TBS |
| Double-signing | −90% TBS + 14-day committee ban |
| Repeat double-signing | Permanent ban of the identity |
Judged relative to network noise in the same period, so a general incident does not single out the innocent. Double-signing is the exception — it cannot happen by accident.
This section is load-bearing. Anything below that reads as an admission of weakness is information, not an unfinished draft — the specification records open problems as open rather than describing them away.
Fixed in this version
Open risks, stated without embellishment
RUN A NODE
Build the client, start relaying, and let the trust graph do the rest. No capital required at any level.
https://rpc.testnet.astrolune.networkAstrolune has not launched. Every figure below is a fixture for interface work, not network telemetry.