A public search you can join, on a problem from 1997.

This is how a round is meant to pay out. Every step below runs today against a local vault in tests, and none of it has ever moved real money.

1. You walk the curve.

   Your GPU follows a pseudo-random path from a start point derived from your own public key. Occasionally it lands on a distinguished point, one whose x-coordinate ends in enough zero bits. That is the only thing you ever send.

2. Each point is worth its expected work.

   A point with w trailing zero bits stands for 2^w steps, and one credit is 2^30 verified steps. No block reward, no halving, no treasury, no vote.

3. A sample of your work is replayed.

   After each epoch closes, a fixed fraction of every contributor's submissions is walked again from scratch, so no choice of identifiers changes how much of your work is checked. Which points get picked depends on a beacon: with an external beacon, that value is published only after the batch seals and nobody could have known it; without one, the operator commits to a secret before the epoch opens and reveals it after auditing, which is unpredictable to contributors but not to an operator colluding with them. A funded round requires the external beacon. One failure forfeits everything.

4. Your balance is committed on chain.

   Every epoch the coordinator posts one Merkle root of every address and its credited steps to a vault on an Ethereum L2, built from balances that already survived that epoch's audit.

5. The collision ends the round and pays everyone.

   When two walks meet, the discrete logarithm falls out. The vault verifies it on chain itself, then each contributor sends one transaction and pulls their share. A prize that arrives weeks later is still claimable under the same root.

The order is deliberate: 97 is the largest instance the reference client can actually finish, so it opens before any kernel exists. 109 is not a record to redo — it is the only rung between 10¹⁴ and 10¹⁹, and that is where the coordinator's decimal-text record format has to stop being decimal text, ahead of the 10¹⁰ points a 131-bit round produces. It is also where a negation map gets validated in the real kernel at real scale. The constant itself is cheaper to check than that: a broken negation map does not crash and does not change throughput, it only silently costs the 1.41× it was meant to buy, and 300 independent 40-bit solves pin the mean to ±2.8%, against a 29% shift — ten sigma, in forty-six seconds on one machine. So the arithmetic can be caught long before 109; what 109 buys is everything that only appears at scale. Those GPU figures assume a kernel nobody has written yet. On the reference Python client, Exercise 97 is about seventy-nine eight-core machines running for ten days, and rho is a random process besides: there is a one-in-ten chance of finishing at 0.37× that and a one-in-ten chance of still running at 1.71×. The gap between those two rows is the whole invitation. Expected steps are 1.25·√n for the rho rows and 2·√(interval) for the kangaroo row. Rates assume 4×10¹⁰ steps per second per card, extrapolated from published 256-bit kangaroo throughput and not yet measured on a 131-bit field. Solving 131 bits says nothing about the 256-bit curves securing your wallet; the gap is a factor of 2⁶².

A single solve proves almost nothing: rho's completion count has a standard deviation near half its mean, so a round ending at 40% or at 200% of expectation is unremarkable. So we solve many independent instances at each size and check every answer against the generator's secret. The tool that does it is in the repository, and the table is one command.

Fitted scaling exponent 0.5003 against the group size, R² = 0.9999: cost is square-root, with no drift across the range. The pooled mean is 1.295 against a theoretical 1.2533, and the 3.3% excess is accounted for rather than waved at — Teske's deviation for a 32-entry adding walk is about 1.6%, and the batched walker discards its in-flight walks when the collision lands, capped at 1% of the expected work per size, giving 1.2533 × 1.016 × 1.01 ≈ 1.285. What remains sits inside the intervals above. Before the walk's branch function was decorrelated from the distinguished-point test, every distinguished point took the same branch out of 128 — a defect that would have surfaced only as a slightly wrong constant, which is why this measurement exists.

Checking work must cost far less than doing it, or the network simply pays for the search twice. A walk is checkpointed every 2^v steps, and each submitted point commits to a Merkle root over its own checkpoint chain, fixed before the contributor can learn which segment will be challenged. An audit opens two checkpoints with proofs and replays only the segment between them.

Measured on the round above. An earlier design replayed each walk in full and, at settlement, replayed every point, which cost the same order of work as the entire search: a rounding error at demonstration scale, a second complete search at 131 bits. A permanent test now asserts the ratio stays under two percent, so that regression cannot come back quietly. What the audit buys for that price is stated precisely rather than as one number: a point whose coefficients fail a·G + b·Q = (x, y) is caught by any challenge, because every segment re-checks that relation; a point with a valid relation but a broken checkpoint chain escapes unless the segment we open is the broken one.