╔══════════════════════════════════════════════════════════════════════════════╗
║                                                                              ║
The Carpocratian Church presents

The Carpocratian Church of
Commonality & Equality

Presents

CASH THAT BLEEDS
Private · Bearer · Unlinkable
║                                                                              ║
╚══════════════════════════════════════════════════════════════════════════════╝

What Is Scarcity?

Chaumian e-cash for the internet. Blind-signed bearer tokens with double-spend prevention — no blockchains, no mining, no global ledgers.

  • Blind signatures — issuer signs without seeing what they sign
  • Bearer tokens — possession is ownership, no addresses
  • Unlinkable — issuance and spending cannot be correlated
  • No blockchain — nullifier gossip + threshold timestamps
  • No fees — zero-cost transfers
  • Issuer-as-mint — you choose which mints to trust

The Chaumian model: the protocol guarantees privacy and double-spend detection. The mint establishes policy. Vendors choose which mints they accept — just as merchants choose which banks' cards they take.

╚══════════════════════════════════════════════════════════════════════════════╝

Lazy Demurrage: Money That Metabolizes

Tokens have a validity window (~1.5 years). If not transferred before expiry, they die.

TOKEN LIFESPAN

This isn't a bug. It's the point:

  • Anti-hoarding — use it or lose it
  • Self-pruning — lost keys don't haunt the network forever
  • High velocity — money that circulates

Based on Silvio Gesell's "Freigeld" and the Wörgl experiment (1932).

╚══════════════════════════════════════════════════════════════════════════════╝

How It Works

flowchart TD
    A[/"TOKEN"/]
    A --> B["1"]
    B --> C["2"]
    C --> D["3"]
    D --> E["4"]
    E --> F["5"]
    F --> G[/"DONE"/]
1
NULLIFIER
SHA-256(secret || tokenId)
A unique "spend marker" derived from your token's secret. Publishing it proves you spent the token without revealing which token you hold. Same token = same nullifier = caught double-spend.
2
VOPRF BLINDING
Freebird · P-256 · RFC 9497
Verifiable Oblivious Pseudo-Random Function. The mint signs your blinded request without learning what they signed. You unblind to get a valid authorization token. They approved you but can't trace you.
3
OWNERSHIP PROOF
Schnorr signature · DLEQ
A zero-knowledge proof binding your nullifier to the transfer. Proves you know the token's secret without revealing it. Cryptographically commits you to this specific transaction.
4
WITNESS TIMESTAMP
BLS12-381 · threshold 3-of-5
A federation of independent witnesses. Each signs your nullifier+timestamp. Aggregate 3 signatures into 1 compact proof. Establishes canonical ordering without a blockchain. Optionally anchored to Ethereum for tamper-proof auditability.
5
GOSSIP BROADCAST
P2P · epidemic protocol
Your nullifier propagates through the network like a rumor. Peers cache seen nullifiers. Second appearance = double-spend attempt. Fast detection (~50ms) with eventual consistency.
DOUBLE-SPEND DETECTION
Fast path gossip network (~50ms) · Witness path federation query (deterministic) · Confidence scoring tunable risk tolerance 
╚══════════════════════════════════════════════════════════════════════════════╝

The Three Pillars

FREEBIRD
The Mint
  • P-256 VOPRF blind signatures (RFC 9497)
  • DLEQ proof verification
  • Schnorr ownership proofs
  • Issuer controls token policy
github.com/flammafex/freebird
WITNESS
The Notary
  • BLS12-381 threshold signatures
  • Canonical ordering without blockchain
  • Ethereum anchoring for auditability
  • Anti-censorship federation design
github.com/flammafex/witness
HYPERTOKEN
The Network
  • WebSocket relay + WebRTC upgrade
  • Gossip-based nullifier propagation
  • Peer reputation scoring
  • E2E encryption (ECDH + AES-256-GCM)
github.com/flammafex/hypertoken 
╚══════════════════════════════════════════════════════════════════════════════╝

Trust Model

Scarcity follows the Chaumian model: the protocol provides cryptographic guarantees. The mint establishes economic policy.

PROTOCOL Privacy, unlinkability, double-spend detection
MINT Who can issue, how much, backed by what
WITNESS Ordering, auditability, tamper-proof history
VENDOR Chooses which mints to accept

The software doesn't enforce supply limits — the mint does. This is by design: monetary policy belongs to institutions, not protocols. Witness attestations (optionally anchored to Ethereum) make that policy auditable.

╚══════════════════════════════════════════════════════════════════════════════╝

Advanced Operations

SPLIT Divide token into multiple smaller tokens
MERGE Combine multiple tokens into one
HTLC Hash/time-locked conditional payments
BRIDGE Cross-federation token transfer
MULTI-PARTY Atomic transfer to multiple recipients
TOR Native .onion service support 
╚══════════════════════════════════════════════════════════════════════════════╝

Run Your Own Mint

# Clone and build
git clone https://github.com/flammafex/scarcity.git
cd scarcity

# Docker: run everything (recommended)
docker compose up --build

# Or manually:
npm install
npm run build
npm test

# Start web wallet
npm run web        # http://localhost:3000

# Start explorer
npm run explorer   # http://localhost:3001

# CLI operations
scar wallet create alice
scar token mint alice 100
scar token list alice
        
╚══════════════════════════════════════════════════════════════════════════════╝

FAQ

Is this a blockchain?
No. No global ledger, no mining, no consensus. Nullifier gossip + threshold timestamps.
Is this a cryptocurrency?
It's Chaumian e-cash. Blind-signed bearer tokens issued by trusted mints, not a permissionless ledger. Think digital banknotes, not Bitcoin.
How do you prevent double-spending?
Nullifiers broadcast P2P. If seen twice, reject. Witness federation provides deterministic ground truth for disputes.
Who controls the money supply?
The mint operator (Freebird issuer). The protocol doesn't enforce supply limits — the mint does. Witness attestations make issuance auditable, optionally anchored to Ethereum for tamper-proof history.
Why trust a mint?
Same reason you trust a bank: reputation, auditability, legal obligation. But unlike banks, the mint can't see your transactions — VOPRF blinds them. Vendors choose which mints to accept.
Why do tokens expire?
Lazy demurrage. Lost keys don't create permanent dead weight. Money circulates, not accumulates. Based on Gesell's Freigeld.
Is this production-ready?
Research prototype. Core crypto is real (VOPRF, BLS, Schnorr). Needs security audits.
╚══════════════════════════════════════════════════════════════════════════════╝