Proof of Space Time: A Secure Datachain Consensus Protocol

I. Introduction: Consensus Through Space and Time

Conventional Proof of Work protocols exhibit probabilistic finality, significant energy inefficiency, and vulnerability to chain reorganizations and selfish mining attacks. Proof of Stake alternatives introduce different centralization risks through wealth‑based dynamics and the nothing‑at‑stake problem. Proof of Space Time (PoST) addresses these limitations by utilizing storage capacity, an abundant and commoditized resource, combined with proofs of elapsed time to create a consensus model that is both secure and accessible [1].

PoST operates through three interconnected layers. First, miners commit physical storage space by generating cryptographic plots, establishing a sybil‑resistant binding between identity and resource commitment [2][3]. Second, nodes maintain a decentralized time consensus through peer sampling, allowing the network to agree on a shared notion of time without relying on external clocks [4]. Third, miners compute deadlines from their plots and broadcast these commitments as intents; the lowest valid intent received during a 30‑second grace period determines the next block forger, achieving deterministic finality immediately upon the window’s close.

The protocol is defined by four core principles:

• Storage Commitment: Precomputed plots demonstrate dedicated space through non‑interactive proofs using the Shabal‑256 hash function.
• Decentralized Time Consensus: Nodes establish a shared chain time through peer sampling and offset adjustment, enabling local time alignment without global synchronization.
• Proof of Time: Deadline calculations with grace periods ensure temporal integrity using verifiable delay functions, with intents serving as binding commitments to mine at specified deadlines.
• Two‑Tier Mining: A structure that balances individual participation with pooled efficiency through handicap mechanisms, win limits, and reserved solo‑only blocks.

The following sections elaborate each layer in turn, demonstrating how they combine to form a consensus protocol with absolute finality and robust resistance to known attack vectors.

II. Proof of Space: Plot Generation and Storage Commitment

Miners allocate hard drive space to generate plots, which are files containing precomputed cryptographic hashes. The plotting process uses the Shabal‑256 hash function, iteratively applied and keyed by the miner’s account identifier. Each plot is divided into nonces; each nonce occupies 256 KiB and is subdivided into 4096 scoops of 64 bytes each. Plotting is computationally intensive but performed once per allocation.

Mining itself requires only reading the relevant 64‑byte scoop from disk for each nonce, and the total disk read per block is proportional to the number of nonces held. With typical consumer drives, this operation consumes a small fraction of the energy required for equivalent Proof of Work mining [5].

The security of PoST derives from the computational fact that generating plots on demand is infeasible due to the one-way nature of the hash function. The initial plotting phase requires iteratively hashing with the miner’s account identifier, a computationally intensive process that cannot be shortcut. Once plots are generated, however, reading the required scoop for any given block is a trivial disk lookup. This asymmetry between plot generation and plot reading ensures that miners must continuously dedicate storage space to participate, rather than computing proofs on the fly [2][3].

This creates a sybil‑resistant mechanism where influence is proportional to verifiable resource commitment. Unlike Proof of Work, where computational power can be redirected instantaneously, storage commitments create persistent binding between the miner and the network. The handicap mechanism described in section V below further discourages excessive concentration by reducing the win probability of miners who have already won recently, promoting a more equitable distribution of block rewards [4].

When a new block is proposed, miners compute the current generation signature from the previous block’s signature and generator identifier. The generation signature, combined with the block height, determines which scoop index must be read from each nonce. Miners then read the corresponding 64‑byte scoop from their plots, setting the stage for the deadline calculation described in section IV.

III. Decentralized Time Consensus

Before deadlines can be evaluated, nodes must share a common reference frame for time. PoST does not rely on globally synchronized system clocks. Instead, each node maintains a chain time value derived from its local clock adjusted by an offset computed from reports of its directly connected peers.

The chain time is computed as:

chain_time = floor((system_time - NETWORK_EPOCH + 500 + ms_adjust) / 1000)

where system_time is the current time in milliseconds since the Unix epoch, NETWORK_EPOCH is the network genesis time, 500 provides rounding offset for integer second alignment, and ms_adjust is a dynamic offset updated based on peer reports. This self-healing property makes the protocol resilient to local clock drift.

Nodes sample time offsets from their peer connections, typically 10 to 20 peers. For each peer, the node computes the difference between its own chain time and the peer’s reported chain time. Differences exceeding a threshold of 500 milliseconds are categorized as problematic. The binned mode algorithm groups these differences into 500 millisecond bins with neighbor smoothing to approximate the mode of the distribution. If 70 percent or more of sampled peers show acceptable alignment (difference below 500 ms), no adjustment is made. Otherwise, the node increments or decrements its ms_adjust value incrementally toward the computed mode, correcting its chain time over successive recalibration cycles.

This design ensures that time converges within each node’s local peer network. What matters is the consensus among a node’s own peers, not the entire network. There is an expected gradient of time offsets across the whole network, which is acceptable because the 30‑second grace period described in section IV absorbs local discrepancies. This tolerance is a key advantage of PoST over protocols that require precise global synchronization.

In a network of thousands of nodes, fewer than one percent of intents might arrive five to ten seconds late in transient segments, but the grace period rejects only those arriving more than 30 seconds after the triggering intent, preventing exploits. No chain forks occur because the protocol deterministically selects the lowest deadline per block; transient variances only slightly shuffle submission order without affecting outcomes.

Self‑healing convergence occurs rapidly. Gossip‑based P2P models, as simulated in ns‑3 for blockchain networks, demonstrate 80 to 90 percent alignment within one block interval (approximately two minutes) and wide alignment with less than two seconds of global variance by three blocks, as the medians average out via overlapping segments [6][7].

The binned mode algorithm further enhances this in partial samples by clustering problematic millisecond differences into 500 millisecond bins with neighbor smoothing, approximating the direct median and accelerating convergence in noisy conditions. For example, the mode of binned differences yields approximately zero millisecond adjustment in balanced transients, even with only ten to twenty peer views.

The offset adjustment mechanism handles clock drift gracefully, but it does not interfere with nodes that maintain accurate time through external sources such as NTP. An honest peer with a properly synchronized clock will compute offsets near zero, requiring no adjustment. Conversely, dishonest peers have nothing to gain from reporting skewed offsets, as the binned mode algorithm treats their reports as outliers and discounts them.

This local consensus model means that if a node finds itself in a malicious subnet where a majority of its peers report skewed times, it may adopt a correspondingly skewed offset, effectively isolating itself. Such isolation does not harm the rest of the network; the node’s blocks will be rejected by honest peers due to deadline mismatches. Node operators can avoid this by carefully curating their peer connections. The 30‑second grace period comfortably accommodates the typical time variations across well‑connected peers.

IV. Proof of Time: Deadlines, Intents, and Block Finality

With a shared chain time established, miners can now generate proofs of elapsed time. For each nonce, the miner hashes the previously read 64‑byte scoop together with the current generation signature, producing a 256‑bit hit value. This hit is then transformed into a deadline: a scalar indicating the minimum number of seconds the miner must wait before forging the next block, measured from the previous block’s timestamp according to the node’s chain time.

A preliminary deadline is obtained as preliminary = hit / base_target, where base_target is a fixed network parameter (2,000,000,000). This preliminary value undergoes a logarithmic transformation specific to the mining tier.

For solo mining, the formula deadline = floor( log10(preliminary) * 55 + 73 ) is applied, with a minimum enforced value of 128 seconds. After this transformation, if the miner has won five or more of the last ten blocks, a 240‑second handicap is added. The resulting value is then capped at a maximum of 300 seconds. The effective chance of winning remains proportional to the number of nonces, because the miner independently computes a deadline for each nonce and the lowest among them is submitted.

For share mining, a different transformation is applied using the formula deadline = floor( ln(preliminary) * (120 / ln(120)) ). After this transformation, 50 seconds are added. The result is subject to a minimum floor of 120 seconds. At certain heights defined by protocol rules, extremely low deadlines are disqualified by setting them to a high value (1120 seconds). If the next block is a solo‑only block (heights congruent to 1 modulo 5, described in section V), share mining is disabled entirely.

When a miner computes a valid deadline, it packages this value along with its account identifier, the corresponding nonce, the mining tier, and a cryptographic signature into a small data packet called an intent. This intent serves as a binding commitment to mine the next block at the specified deadline. The miner broadcasts this intent immediately upon discovery and ceases mining for that block, as continued searching would only yield worse deadlines due to elapsed time.

Intents are gossiped across the network through existing peer propagation mechanisms. A grace period of 30 seconds begins when a node first observes a valid intent for the next block. During this window, the node accepts and validates intents from any miner that may have found a solution around the same time, accommodating network propagation delays and ensuring that all competitive solutions have an opportunity to arrive.

At grace period expiration, the node selects the intent with the lowest deadline as the winner. Any intent received after the grace period expires is rejected outright. In the event of a tie where two miners produce identical lowest deadlines, the block with the lower identifier is selected. This grace period is what allows for deterministic finality.

Blocks exist in three distinct states. An IN‑PROGRESS block is not yet mined but will be mined in the near future. A GRACE MODE block indicates that a valid intent has been received and the 30‑second grace window is active. A FINAL block has passed its grace period and is considered irrevocable. Once a block reaches FINAL state, it can never be reorganized.

V. Two‑Tier Mining Structure

PoST supports two parallel mining tiers to balance decentralization with predictable rewards. The total block reward is split between these tiers according to a hybrid distribution model that rewards both the solo winner and multiple share miners from the same block. This two-tier design is a distinguishing feature of proof of space time.

• Solo Tier: Individual miners submit intents from their own plots. 51% of the mining reward for each block is allocated to the solo miner who produced the winning intent. To prevent concentration by large miners, the handicap mechanism described in section IV reduces their probability of winning again until the five‑win elapses within 10 rolling blocks. Additionally, solo‑only blocks occur at heights congruent to 1 modulo 5 (i.e., 1, 6, 11, …). In these blocks, share mining is disabled, and the solo miner receives the full block reward, further incentivizing individual participation.
• Share Tier: The remaining 49% of the mining reward for standard blocks is divided into seven equal mining shares awarded to seven distinct share‑mining winners. This structure allows miners with smaller storage commitments to compete for a portion of the block reward without requiring the lowest overall deadline. Share miners are selected based on their submitted intents, with the seven lowest deadlines among non‑winning submissions each receiving one share. If fewer than seven share miners submit valid intents for a given block, the unallocated share rewards are unclaimed. This mechanism ensures that block rewards are fairly distributed even in low‑participation scenarios.

Both tiers earn block rewards. The solo miner additionally collects transaction fees from the transactions included in the block. In datachain implementations, miners also receive firing fees from semantic relon references, aligning mining incentives with network utility. These mechanisms collectively prevent dominance by large storage holders and promote broader participation.

Economic simulations of the two‑tier mining structure indicate a Gini coefficient below 0.3 for mining rewards. This compares favorably to the 0.39 coefficient reported for PoVF‑based blockchains [4], which lack PoST’s additional fairness mechanisms such as solo‑only blocks, handicap rules, and share mining. The combination of these features promotes a more equitable distribution of rewards.

VI. Security Model: Deterministic Finality and Attack Resistance

VI.I. Deterministic Finality

In PoST, a block achieves finality immediately upon expiration of its grace period. Unlike probabilistic consensus models where finality is asymptotic and reorganizations are possible, Proof of Space Time provides irrevocable confirmation. Once the 30‑second window closes and the winning intent is selected, no alternative chain can ever overtake it.

Any competing block at the same height would require an intent with a lower deadline than the winner, submitted within the same grace window. Such an intent would have to arrive after the fact, but any intent received after its grace window expires is invalid. Therefore, an adversary controlling even a majority of storage cannot reorganize history.

The only scenario where a node may produce a divergent chain is during adverse network conditions that might prevent it from receiving the winning intent for a block. In such a case, the node may continue mining based on its local view, generating a block that is valid according to its own rules. Upon reconnection, two chains now exist that share a common ancestor but have diverged at that height. Neither chain is automatically preferred by the protocol; nodes that maintain connections to peers on both chains will see two valid options.

The node operator must exercise sovereign choice, deciding which chain to follow based on their own criteria, such as peer relationships, exchange support, or community consensus. This is not a reorganization in the conventional sense, as it requires explicit operator action and does not affect other nodes. It is analogous to creating another competing chain through intent, but one that remains isolated unless an operator deliberately chooses to adopt it.

This design prioritizes operator autonomy over protocol‑enforced resolution, recognizing that edge cases such as intermittent disconnection are better managed through human judgment than automated rules that might otherwise be exploited.

VI.II. Impossibility of Majority Space Attacks

In conventional Proof of Work, an attacker controlling more than half of the network’s hashrate can produce a private, longer chain and reveal it to the network, causing a reorganization that rewrites history. In PoST, this attack is structurally impossible. Deadlines are verifiable and tied to specific previous blocks; they cannot be precomputed for future blocks because the generation signature changes with each block.

An attacker withholding discovered deadlines only forfeits opportunities to win those blocks. To produce an alternative chain, the attacker would need to generate a competing block at the same height with a lower deadline than the honest winner, submitted within the same 30‑second grace window. Such an intent would have to arrive after the honest intent, but any intent received after its grace window expires is invalid.

Because blocks expire after their grace period, any block submitted late is automatically rejected by the network. Even with a majority of storage, the attacker cannot retroactively produce valid intents for past blocks. The only way to have a different chain would have been to have produced different intents at the time those blocks were being formed. Since that did not happen, reorganization is impossible. Thus, a 51 percent attack is not merely difficult or expensive. It is structurally impossible by design.

VI.III. Selfish Mining Resistance

Selfish mining attacks rely on withholding discovered blocks to orphan honest competitors’ work. In the attack is impossible because the relevant units are intents, not blocks, and the grace period enforces a transparency mandate. A miner discovering a low deadline cannot withhold it advantageously.

Miners stop mining upon discovering a solution and broadcasting their intent, as continued nonce iteration yields worse deadlines due to elapsed time. If a miner keeps the intent private, it never triggers the grace period, and no other node recognizes it. If the miner broadcasts the intent after the grace period has expired for a competing intent, it is rejected because intents must arrive before the deadline expires. Even if a miner withholds an intent, forges a block privately, and broadcasts the block after the grace period, the block fails validation because its deadline has no corresponding intent recorded during the grace window. A better deadline without timely disclosure has no effect.

VI.IV. Sybil Attack Resistance

Sybil attacks against the time consensus mechanism are rendered infeasible through the chaotic dynamics of peer‑to‑peer time synchronization, a phenomenon analogous to the n‑body problem in celestial mechanics. When a node receives time offset reports from its peers, it adjusts its local chain time and propagates this adjusted value to its neighbors.

Those neighbors, in turn, adjust based on their own peer sets and propagate further. After only two or three gossip hops, the offsets become a product of countless interacting adjustments, a system where the attacker cannot predict, let alone control, the final outcome.

Several complementary layers reinforce this defence.

First, node operators exercise sovereignty over peer connections. They curate trusted peers, set connection limits, and can blacklist misbehaving nodes. An attacker would need to comprise over 70 percent of a node’s direct peers to significantly skew its time offset, a condition easily avoided through careful peer selection.

Second, the binned mode algorithm for offset calculation treats outlier reports as noise, clustering them against the mode of honest peer reports. Anomalous offsets are therefore discounted rather than adopted.

Third, even if an attacker attempted to shift the network’s perceived time, they would need to simultaneously comprise over 70 percent of peer connections across a vast majority of nodes, maintaining this dominance across the entire network over multiple recalibration cycles.

The coordination required to achieve such a feat is astronomically difficult, and even if successful, the protocol would continue functioning identically. There is no external reference time; only relative alignment among peers matters. A network‑wide skew of any magnitude does not break consensus; it simply redefines the shared reference. The grace period absorbs the discrepancy, blocks continue to be produced, and the attacker gains no advantage. The effort required to orchestrate such a skew is immense, and the outcome is utterly futile.

The scenario where an attacker isolates a node in a local bubble with skewed time, leading that node to accept a block that the rest of the network rejects, is also mitigated. The isolated node would, upon attempting to broadcast its block, find that its peers do not recognize the intent because it arrived outside their grace windows.

The node would then either correct its offset upon comparing with honest peers or remain isolated, a self‑contained fork that does not affect the canonical chain. Node operators who maintain diverse, trusted peer connections are highly unlikely to find themselves in such a bubble. Should malicious peers persist in reporting skewed offsets, they are blacklisted, forcing them into irrelevance. The network may then acquire new, honest peers as needed.

VI.V. Netsplit Resilience

Internet partitioning events that separate the network into isolated segments present a theoretical challenge for any consensus protocol. Separated segments would each continue producing blocks according to local rules, potentially creating divergent chains. However, several factors render this scenario inconsequential in practice. First, the probability of complete intercontinental isolation is astronomically low due to redundant submarine cables, satellite links, and diverse routing paths [8]. Second, even in the event of a temporary partition, the resulting chains are not alternate histories in the sense of competing for canonical status; they are simply two separate chains that happen to share a common ancestor.

Upon reconnection, nodes do not automatically switch to the longer chain. Instead, node operators exercise sovereign choice between chains, analogous to a hard fork scenario. This approach prioritizes operator autonomy over protocol‑enforced resolution, recognizing that rare extreme events are better managed through human judgment than automated rules that might be exploited.

VII. Economic Model and Emission Schedule

The native token is denominated with two decimal places, where one coin equals one hundred annies, the lowest unit of measure. Maximum supply is 2.2 trillion coins, equivalent to 220 trillion annies. The emission schedule progresses through three distinct phases mapped to lunar cycles of approximately 29.53 days each. This long-term economic model supports sustainability for decades to come.

• Primary Mining Phase (Cycles 1 through 397): At genesis, each block produces a base reward of one million coins plus transaction fees. With each successive lunar cycle, the total block reward decreases by one percent. This phase extends for approximately thirty years of continuous mining.
• Sunset Mining Phase (Cycles 398 through 690): Following the primary decay phase, the block reward stabilizes at 18,500 coins per block plus fees for an additional twenty‑two years.
• Fee‑Only Phase (Cycle 691 onward): After cycle 690, block rewards cease entirely. Miners are compensated exclusively through transaction fees and, in datachain implementations, firing fees from semantic relon references.

The ANNE Development Fund (ADF) receives a portion of each block reward throughout the primary and sunset phases. At genesis, the split allocates 70 percent to mining rewards and 30 percent to the ADF. By cycle 154, the ADF portion decreases to 14.7 percent through the same one percent per‑cycle decay applied to the fund’s allocation percentage. The ADF is not a pre‑mine; it is funded progressively as blocks are mined. Funds are designated for API developers, layer‑two ecosystem, exchange listings, marketing, bounties, and other ecosystem initiatives. This structure eliminates dependence on venture capital, post‑launch funding, or donations, and the lack thereof, that might compromise project integrity.

VIII. Integration with Datachain Ecosystems

Beyond its role as a consensus mechanism, PoST provides the foundational security layer for higher‑level data protocols. In datachain architectures such as ANNE, each block contains a set of relons, the fundamental units representing assertions, relationships, and knowledge graph edges. These relons are permanently recorded in the block, and the block’s generation signature, derived from the previous block’s signature and block hash, chains them together in an immutable sequence. This same signature is then used in the next cycle’s deadline computations, binding the integrity of the data layer directly to the consensus process.

This integration yields several ecosystem benefits:

• Sustainable Mining. Storage‑based mining consumes minimal ongoing energy compared to Proof of Work. Hard drives can be repurposed after use, reducing electronic waste.
• Low Barriers to Entry. Consumer hardware with standard hard drives is sufficient for competitive participation, promoting decentralization.
• Queryable Ledger. The finalized block history provides an immutable source for the neuromorphic hypergraph, with every relon permanently anchored and verifiable.
• Economic Alignment. Mining rewards are augmented by firing fees from semantic references, directly compensating those who secure the knowledge graph. When a relon is referenced or updated, a small fee accrues to the miners of the block containing that relon, creating ongoing incentive to maintain the ledger.

IX. Performance and Implementation Considerations

PoST is designed for deployment on resource‑constrained devices, including personal computers and edge hardware. Key performance characteristics include:

• Block Interval: The protocol targets a block time of approximately one minute and fifty seconds. This interval is maintained through the interaction of the fixed base target with the logarithmic deadline transformation described in Section IV, providing predictable block production without variable difficulty adjustments.
• Plot Read Overhead: For each block, the miner reads one 64‑byte scoop from every nonce in their plot. A 16 TiB plot contains approximately 64 million nonces, yet the scanning process is sufficiently efficient that miners routinely operate at this scale on single drives without parallelization. Empirical studies of Proof of Capacity mining confirm that the workload remains feasible on consumer hardware [5].
• Intent Gossip: Intent packets are small (approximately 150 bytes) and propagate through the peer‑to‑peer mesh with negligible overhead. Miners begin scanning as soon as a new block starts and submit their intent immediately upon finding a solution, at which point they cease mining for that block. The first valid intent observed by a node triggers a 30‑second grace period, allowing time for other competitive intents to arrive via gossip. Simulations of gossip‑based protocols in 10,000‑node networks indicate that intents reach 90 percent of participants within 10 seconds [6][7][9], and the 30‑second window is specifically designed to accommodate these propagation variances, ensuring that all competitive intents arrive before the window closes.
• No Decompression Overhead: Plot files contain raw data with no headers and no compression. This means the CPU performs no decompression work during mining, keeping energy consumption low and scanning fast. A 1 terabyte drive provides exactly 1 terabyte of effective mining capacity.

Support

ANNE Media is a sovereign non-profit organization. All of our expenses are funded by user donations. If you appreciate our efforts toward a free and sovereign web, please consider supporting us.

Donate

Thank you kind sir or ma’am

84VrmTNQq4hbfBQce5LfUe8BHmBFSDKHHFcSws6FRa9oiDUQANBkRnKYChabe9HRYUVAu9tcojXNFJL484KQPdJFCxRecbP