Midstate's minimum-trust bet: delete what you cannot verify

ciphernom — previously known as BTConometrics, the quant who took apart stock-to-flow — arrived at post-quantum design the statistician's way: watching the estimated qubits needed to break RSA-2048 fall from a billion (2012) to twenty million (2019) to under a million (2025) to under a hundred thousand (2026). Four orders of magnitude in fourteen years, each drop faster than the last. His conclusion is not that quantum computers are here; it is that the trend line deserves one honest chain.

Midstate is that chain, and its defining discipline is subtraction. No elliptic curve exists anywhere in the code — Winternitz one-time signatures, Merkle schemes, and a BLAKE3 chain of a million hashes per block are the whole cryptographic pantry. At one point a Fiat-Shamir construction was built to shortcut full-chain verification. It failed — a hash chain has no algebraic structure to compress — and the failure was kept public. Later, a working zkSTARK path was removed entirely: it functioned, but it did not belong to the minimum trust surface.

Two mechanisms stand out. A Bayesian finality estimator: each node holds a belief about network honesty, and observing a reorg slides the confirmation depth it demands upward (capped at 10,000 blocks ≈ a week) — an attacker toggling hashrate only makes honest nodes more paranoid, which is the point. And power-of-two denominations: with only 64 possible amounts, values stop being a fingerprint, UTXOs stay blind until spent, and CoinJoin becomes effectively free.

The pool design is likewise anti-operator: share Merkle trees are committed into blocks so every miner can verify their own scoring on every job — the pool cannot quietly shave them.

• No external audit — the primitives are old, the composition is new, and nothing adversarial has reviewed the assembly (two-phase transactions, covenants, 576-byte signatures).
• Bus factor one, stated by the author himself.
• Liquidity 'does not exist': one order book, ticks that swing -99% to +59% — every valuation here is arithmetic, not information.
• BLAKE3 is not memory-hard: an ASIC does not need to break the design, only out-hash CPUs. Sequential construction defers that hardware answer; it does not delete it.
• Denominations + CoinJoin + Dandelion put the chain squarely in the regulatory family that gets delisted first — and there is no company to negotiate with.

The tracked-set summary: unusually honest engineering wrapped in an unusually exposed project — the definition of a lowcap before the market decides whether it matters. The author's stated endgame is ossification: a chain that eventually stops needing him. Until an audit says otherwise, that endgame is a promise, not a property.