NOCTIS is a private chain where mining means proving. Every block carries a proof of a 1,024-step computation over the Goldilocks field. Every transfer hides the sender, the receiver and the amount. Every hundred blocks the chain writes its own fingerprint onto Robinhood Chain.
Hash grinding proves you burned electricity. NOCTIS's miners do something you can check: they run a fixed program, commit to every step of it, and hand the network a proof that the program ran. The commitment is what has to beat the difficulty, so you can't win a block without doing the computation, and nobody has to redo it to believe you.
The block header and a nonce are hashed into two Goldilocks field elements: the program's starting state (a₀, b₀).
Each step is a' = (a+b)⁷ + cᵢ, b' = a over p = 2⁶⁴ − 2³² + 1. x⁷ is a permutation of this field, so no step can be skipped.
All 1,024 states become leaves of a Merkle tree. Its root is the trace commitment, one hash binding every step.
sha256(root ‖ header ‖ nonce) × diff < 2²⁵⁶. Miss, and you start a whole new trace with a new nonce.
Fiat–Shamir draws 32 steps from the root. The miner opens each one and the step after, and nodes check every transition in about 4 ms.
Nockchain made proof-of-work into proof-of-proof: miners generate proofs of a fixed puzzle in the Goldilocks field, and the chain rewards provers instead of hashers. NOCTIS takes that consensus idea, keeps the field, and puts it under a chain where every note is private.
The 32 steps are picked after the trace is committed, so a miner can't know in advance which steps get checked. Faking a fraction f of the trace survives with probability (1 − f)³². Faking 20% of it gets caught over 99.9% of the time, so honest proving is the cheapest way to win.
NOCTIS keeps value in notes, one-time outputs like Nockchain's UTXO notes. The difference is what the ledger can see: on NOCTIS, nothing that links a note to a person or a number.
Each spend signs with 16 notes from the chain (an MLSAG over ristretto255). Fifteen are decoys, and the signature doesn't say which one is real. A key image stops the same note being spent twice.
Every payment goes to a fresh one-time key derived from your address. Your address never appears on chain.
Amounts live in commitments. A 48-bit range proof shows each one isn't negative, and the node checks that inputs equal outputs plus the fee without seeing a number.
noctq1 addresses find payments with NIST's lattice KEM, so a recording of today's chain stays unlinkable after a quantum computer arrives.
Open any transaction on the explorer and press verify in your browser. Your machine re-runs the ring signatures and range proofs from the raw transaction.
Like Nockchain, NOCTIS's supply is a power of two and starts at zero. There was no presale and no team allocation. Every NOCTIS in existence came out of a block that a miner proved, and the open miner on this site uses the same work endpoint as the node itself.
2³² NOCTIS, six decimals.
Each block pays 1/524,288 of what is left, so the reward decays smoothly instead of halving in steps.
A permanent floor reward keeps provers paid after the curve flattens.
Difficulty retargets every block over the last five.
Every 100 blocks the node writes noctis-1:<height>:<block hash> to Robinhood Chain as the calldata of a Robinhood Chain transaction. Each anchor is a Robinhood Chain transaction anyone can open on the Robinhood Chain explorer and compare with the same block on the NOCTIS explorer.
A rewrite of NOCTIS's history would have to contradict a record on Robinhood Chain that nobody can edit. $NOCT is the Robinhood Chain token for the network; the anchors tie the token's home chain to the chain it represents.
| NOCTIS | Nockchain | Monero | Zcash | |
|---|---|---|---|---|
| mining | proof of proof (trace) | proof of proof (zkPoW) | RandomX hashing | Equihash hashing |
| field | Goldilocks | Goldilocks | none | none |
| premine | none | none | none | founders' reward |
| supply | 2³² | 2³² | tail emission | 21M |
| hidden sender | ring of 16 | no | ring of 16 | shielded pool |
| hidden amount | yes | no | yes | shielded pool |
| quantum-safe receive | ML-KEM-768 | no | no | no |
| browser miner | yes | no | no | no |
| anchored to | Robinhood Chain | none | none | none |
NOCTIS is a private blockchain mined by proof of proof. Blocks are won by proving a computation instead of grinding a hash, and every transaction hides the sender, the receiver and the amount. The chain's history is anchored to Robinhood Chain every 100 blocks, and $NOCT is the network's token on Robinhood Chain.
Nockchain replaced hash-based proof of work with proof of proof: miners generate proofs of a fixed puzzle over the Goldilocks field, the supply is 2³² with no premine, and value lives in UTXO notes. NOCTIS follows the same model: Goldilocks field, a fixed puzzle, proofs in every block, 2³² supply, no premine, notes. What NOCTIS adds is privacy on every note, quantum-safe payment detection, a miner that runs in a browser tab, and anchoring to Robinhood Chain.
The program starts from two field elements derived from the block header and a nonce, then runs 1,023 rounds of a' = (a+b)⁷ + cᵢ, b' = a over p = 2⁶⁴ − 2³² + 1, with fixed round constants. The miner Merkle-commits all 1,024 states. If sha256 of the root, header and nonce beats the difficulty, the block is theirs, and they attach the start state, the final state and 32 Fiat–Shamir-chosen steps, each with the following step and Merkle paths. The code is client/pop.js, about 60 lines, and the explorer re-runs the check for any recent block.
Not yet. Today each block proves its trace by Merkle commitment plus 32 random step openings, which makes skipping work a losing strategy: faking a fifth of the trace is caught more than 99.9% of the time. A full STARK adds a low-degree test so that a single wrong step is caught. That is phase iii, and the puzzle and field were picked so the move is direct.
Yes. Open /mine, paste your noct1 or noctq1 address, pick a thread count and press start. Each browser thread runs the same program and proof as the node. For all cores, run the command-line prover from the repository: node miner/miner.js YOUR_ADDRESS. Block rewards go straight to your own private address.
Public: blocks, trace roots, proofs, key images, fees, ring members, and the Robinhood Chain anchors. Hidden: who sent a note, who received it, how much it was worth, and which of the 16 ring members was really spent. Coinbase rewards show their amount, as on Monero, but go to stealth keys.
That NOCTIS block N had hash H at the time the anchor was written. Robinhood Chain's record can't be edited afterwards, so any later attempt to present a different history for NOCTIS is checkable against Robinhood Chain by anyone with a block explorer.
In your browser. The wallet makes keys locally, scans the chain locally and builds proofs locally. The node only sees finished transactions. Back up the 64-character seed: it is the only way to restore the wallet.
Yes. The node, wallet, explorer, prover and both CLI tools are in one public repository with unit tests for the cryptography and an end-to-end test that boots a node, mines, sends privately and checks proofs.