NixeonAlphanixprotocol.com
Progress

What we are building, and how far along it is.

An open log rather than a launch calendar. Each track lists its full known plan, so the percentage is counted rather than claimed. Every number below is a real measurement with the date it was taken.

Privacy

Privacyin build

Private amounts

Range, balance and booleanity over lattice commitments, proved in one protocol so the cost does not grow with the number of amount bits. The client proves; the node only verifies.

80%

8 of 10 milestones

  • 2026-07-16Direct range proof chosen over folding
  • 2026-07-16Booleanity, range and balance unified into one protocol
  • 2026-07-17Prover and verifier end to end
  • 2026-07-18Prover compiled to wasm, in-browser round trip
  • 2026-07-19Production parameters
  • 2026-07-23Zero-knowledge tail closed
  • 2026-08-10Wallet scan over RPC
  • 2026-08-12Throughput re-measured against current proof sizes
  • openProof size reduction
  • openPrivacy lane in the browser wallet
Privacyin design

Hiding the transaction graph

Amounts alone are not privacy: who paid whom is still readable. Membership proofs and nullifiers hide the graph. The nullifier switch and membership are one piece of work, because doing half of it would let an observer precompute every note's nullifier.

33%

2 of 6 milestones

  • 2026-08-10Tree layer completed
  • 2026-08-13Specification written
  • openNullifier serial moved to gadget digits
  • openMembership proof bound to the spend proof
  • openAnchor retention, with the root in consensus state
  • openImplementation
Privacyresearch

Selective disclosure

Viewing and audit keys, so a holder can prove what they choose to whom they choose. Disclosure is a capability the holder has, not an obligation the chain imposes.

20%

1 of 5 milestones

  • 2026-07-19Visibility matrix written
  • openViewing-key derivation
  • openAuditor scope and revocation
  • openDisclosure format
  • openImplementation

Authorization

Authorizationin design

Proof-carrying authorization

Spending proves knowledge of a key instead of publishing a signature, so no key that guards funds is ever on the wire. HAWK was withdrawn from NIST standardisation on 29 July 2026, which is what makes this work urgent rather than tidy: a chain that verifies a proof relation can change signature scheme without changing addresses or consensus.

50%

3 of 6 milestones

  • 2026-07-28HAWK key-recovery result assessed
  • 2026-07-30Replacement design written
  • 2026-08-01Internal review found a key-recovery defect in the ownership commitment and specified the fix
  • openHiding randomness and re-derived width
  • openTransparent lane through the prover
  • openImplementation
Authorizationin build

Post-quantum signatures

HAWK was withdrawn from NIST standardisation on 29 July 2026 after a key-recovery result, so the chain moved to ML-DSA. ML-DSA-44 authorizes spends, ML-DSA-65 signs consensus votes and peer identity, and both go through the fips204 crate rather than a hand-port, because the hand-written HAWK port is precisely what the attack landed on. This is the build the public testnet runs today. It has not landed on main, which is why the stage reads branch and the status is not live.

75%

9 of 12 milestones

  • 2026-08-22ML-DSA-44 and ML-DSA-65 adopted over fips204
  • 2026-08-22Seed-anchored address with a four-slot scheme tree
  • 2026-08-22Consensus votes and peer handshake on ML-DSA-65
  • 2026-08-22Spends authorized through the scheme tree
  • 2026-08-23HAWK off every path
  • 2026-08-23Storage schema 9, with an acceptance run
  • 2026-08-24LatticeFold+ prover taken off the node
  • 2026-08-25Root seed derivation moved to Argon2id
  • 2026-08-26Consensus review, with three halting bugs fixed
  • openMerged to main
  • openSLH-DSA parachute slot exercised end to end
  • openExternal review of the migrated stack

Proof systems

Proof systemsin build

Lattice proof engine

The folding proof system and its final-step verifier. Built and measured. Direct range proofs will replace it on the consensus path because they verify far faster for a single transaction, and that wiring is the open milestone below. It is kept because its compression is the right tool for aggregating many proofs at once.

80%

4 of 5 milestones

  • 2026-07-01Unified ring prime locked
  • 2026-07-14Fold with final-step verifier built
  • 2026-07-15Soundness audit of the final step
  • 2026-07-19Performance pass
  • openSupersession by direct range proofs on the consensus path
Proof systemsresearch

Block proofs on the consensus path

Back to the drawing board. The LatticeFold+ prover was removed from the node in August 2026. One fold took about a second against a sub-second block time, so it could never keep pace, and each proof ran to 2.29 MB against a 50 KB target. Nothing verified its output, so removing it changed no guarantee. A proof layer returns from a construction that verifies directly rather than by folding, or not at all. The folding work is not counted below: it was built and then deleted, so counting it would report progress toward something this track is no longer trying to do.

20%

1 of 5 milestones

  • 2026-08-24Folding abandoned, and why, written down
  • openDirect-verification construction chosen
  • openProver and verifier end to end
  • openHeader field committing to the proof
  • openExternal audit of the proof path
Proof systemsresearch

Recursive folding

Folding a fold, for compact light-client proofs at high throughput. Ships when the soundness accounting is solid, not before.

25%

1 of 4 milestones

  • 2026-07-15Candidate final-step verifier reviewed
  • openSoundness accounting
  • openPrototype
  • openParameters

Consensus

Consensuslive

Chain and consensus

A UTXO ledger with lattice commitments, multi-validator BFT consensus with deterministic finality, and sub-second blocks. This is the only track whose code is on main, and everything above is built on it. The build deployed to the public testnet is ahead of main and carries the signature migration tracked under Authorization, so read the two together rather than either alone.

80%

4 of 5 milestones

  • 2026-05-07UTXO state with lattice commitments
  • 2026-06-02Multi-validator BFT consensus merged
  • 2026-06-03Security review, with four network and RPC fixes
  • 2026-06-07Node hardening deployed
  • openHeader aggregation for light clients

Assurance

Assurancenot started

External audit

No milestone here is done, which is the point. An internal cryptography audit completed on 21 June 2026, but external audit is the gate before any production claim, and it has not started.

0%

0 of 3 milestones

  • openScope and firm selection
  • openEngagement
  • openPublished report

Benchmarks

Measured on developer hardware, not on a deployed network. Where a target appears it is our own engineering goal, not a commitment or a forecast. Where none appears we have not set one, and a blank is more useful than a number invented to fill it.

Transparent throughput
2,161 tx/s
no target set

1,000 independent-UTXO transactions, 200 ms blocks, release build, macOS arm64. A lab burst on one machine, not a sustained network figure. Re-measured after the move to ML-DSA-44: the same fixture gave 2,425 tx/s on HAWK-512, so the migration cost about 11%, consistent with ML-DSA-44 verify being dearer per call. Sustained figures on a strictly-chained workload are far lower, around 200 tx/s, where the ceiling is block policy and admission rather than signing.

measured 2026-08-23

Transparent admission latency
p50 75 ms, p99 140 ms
no target set

The same 1,000-transaction run as the row above, under ML-DSA-44. HAWK-512 measured p50 66 ms and p99 132 ms on the identical fixture, so the migration cost about 13% at the median. Latency degrades sharply under saturation.

measured 2026-08-23

Privacy-lane batch verify
121 - 168 tx/s
target 100 tx/s · met

Eight cores, release build, M1 Pro. The consensus-path cost of verifying private transactions in a batch. The conservative endpoint is used for the percentage. This is CPU throughput and it is not the lane's ceiling; see the relay row.

measured 2026-08-12

Privacy-lane ceiling, 1 Gbit relay
40.8 tx/s
target 100 tx/s · 41% of target

Every validator ingests the whole proof before verifying it, so the real ceiling is link bytes per second divided by proof bytes: 4.1 tx/s on 100 Mbit, 408 tx/s on 10 Gbit. This is the number that binds the lane, not batch verify, and it is why proof size is the open item on the private-amounts track.

measured 2026-08-12

Client proving, 2 in / 2 out
6.2 - 6.5 s
no target set

Single-threaded, measured natively on an M1 Pro, not in the browser. In-browser wasm has not been measured and will differ; treat this as a floor for the browser case, not an estimate of it.

measured 2026-08-12

Privacy-lane proof size
2,988.7 KiB
no target set

A 2-in / 2-out transaction. The proof is not carried in the block; see the next row.

measured 2026-08-12

In-block cost per private transaction
28.6 KiB
no target set

The bundle only. Proofs live in separate storage, so roughly 143 private transactions fit a 4 MiB block and proof size does not cut block capacity.

measured 2026-08-12

Tree node hash
1.45 ms
no target set

Eight cores, release, three runs within 3%. A number-theoretic transform is structurally unavailable at this prime, so the speedup came from parallel matrix-vector work rather than a faster transform. The two parallelism axes contend rather than compose: the hash is already internally row-parallel, so fanning out across a block's inputs gives 1.7x on eight cores, not 8x. One lever remains, a larger gadget base, worth roughly 1.8x once the binding parameter is re-derived.

measured 2026-08-10

Membership proof, depth 32
1.426 MB, 1.87 s prove, 437 ms verify
no target set

Two internal tables record the verify figure as 437 ms and 427 ms. The slower number is published.

measured 2026-07-30

Method

Progress is counted

A track's percentage is its completed milestones divided by its total, and the list is the full known plan rather than a sample. A partial list would inflate the number, which is what makes most public roadmaps worthless.

Lab, not network

Benchmarks are single-machine measurements. Where a lab figure and a real ceiling differ, both are published and the binding one is said to be binding.