Pinned Tweet
wrote an outlook for the upcoming “Toccata” hard fork -- native L1 covenants, based zk apps, why the activation window moved, and what the road from feature freeze to mainnet looks like:
medium.com/@michaelsuttonil/…
it’s exciting to watch y’all starting to realize (as well as actually realize/build) what can be built on post-Toccata Kaspa
(with grok and sol)
---
An interesting design tension in state-carrying covenants that require lineage is how you manage a scarce global resource without forcing every update through a single UTXO.
A compressed design keeps the allocation map behind one Merkle root inside a single covenant UTXO. The covenant checks every transition against the rules. For a name service that means a sparse Merkle tree over the keyspace: registering a name proves the slot is empty, updates the root, and creates a separate ownership UTXO for that point.
U(R₀) → U(R₁) + Point(k)
Later transfers of the name can spend the ownership UTXO without touching the root, so they don’t contend with new registrations. Everything that changes the allocation map itself still has to spend the same root-carrying UTXO. Unrelated names serialize on it.
The other way is to partition the space. A split hands each range to its own covenant UTXO from the same lineage. The split has to preserve the global invariants: ranges don’t overlap, budgets still sum correctly, and it validates the contracts that receive the pieces. After that, each range can evolve independently for operations that stay inside it. Splits, merges, and transfers between partitions still need coordinated checks across the UTXOs involved. Otherwise the range UTXOs are independent, so updates in different ranges can proceed concurrently in the DAG.
Lineage is what keeps the pieces part of the same instance. Covenant IDs make this cheap: consensus already tracks which UTXOs belong to a given covenant, so a script only has to validate the local transition. The live range UTXOs (plus the ownership UTXOs for allocated points) are just the current leaves of that lineage. There’s no separate tree object stored on-chain.
@supertypo_kas’s dotk is a pure-partitioning version of this for names. It keeps the invariant that every key is either inside exactly one gap or is exactly one deed. Claiming a name consumes the gap that contains it and emits the remaining gap(s) plus a deed:
Gap((a,b]) → Gap((a,k)) + Deed(k) + Gap((k,b])
Releasing a name consumes the deed and adjacent gaps and merges them back together. The gaps and deeds have different rules, but every point stays accounted for exactly once.
The cost of the partitioned approach shows up in storage mass. KIP-9 makes creating many small-value outputs expensive, so each new range UTXO needs enough KAS locked in it to keep the mass reasonable. That’s intentional. Growing the live frontier means someone has to put capital behind the extra state. Designs that let users opt in, fund additional range UTXOs while the capacity is useful, and later reclaim the KAS by merging ranges again turn that cost into a controllable design choice. The expand-and-contract frontiers in the kcc20 reference code follow the same principle.
A practical middle ground is to start with a chosen number of range UTXOs and put a Merkle root inside each one. Lineage partitions the keyspace; each partition compresses its own allocation state. While that partition count stays fixed, the L1 footprint for the trackers stays constant, registrations in different ranges still don’t contend, and you avoid creating a new range UTXO for every name. You choose how finely to slice the space, how much KAS to lock behind the frontier, and how much residual contention you accept inside each partition.
Hashing helps distribute keys across ranges, but it doesn’t eliminate hot spots. If most operations land in one range you’re back to serializing on that root. At that point the app can allow further on-demand splits of a hot range, again costing locked KAS that users can later reclaim by merging, or just accept the serialization for that slice
SMT-based name service by @IzioDev
github.com/IzioDev/argent-pl…
two years ago, when we were designing based rollups/apps over kaspa with canonical bridging etc, did we have this privacy use case in mind? at least for me, no.
(see posts here:
research.kas.pa/t/on-the-des…
research.kas.pa/t/l1-l2-cano… brainstormed with @dimdumon, @hashdag and @VolokhIlia)
seeing these ideas now being explored for privacy is a reminder of why infrastructure work needs to be sound, diligent and forward thinking. you can’t anticipate every application, but thinking carefully about the foundations can make room for things you hadn’t specifically imagined.
eg with the canonical bridge, the core idea is a pool of resources whose internal distribution is managed by the L2 app state and opaque to L1. this seems to map cleanly to the proposed privacy architecture, with an additional layer where each user’s private state is hidden from everyone else and the app itself verifies user proofs as part of its execution/proving (worth mentioning that these user proofs need not be directly compatible with L1 zk opcodes, only the outer app proof needs to be)
same goes for kip21 and proving work proportional to app activity, which seems rather useful and important here as well.
one more thing i wanted to add here (and we discussed), @WellerOlaf: the based component not only provides censorship resistance but also gives in-app confirmation times driven by L1 frequency and not proof frequency. once an operation is ordered and its execution locally validated, every possible prover is bound to that outcome. no valid proof can advance past it while skipping or changing it
Had a really interesting conversation with Kaspa core developer @michaelsuttonil about the Kaspa Privacy Initiative today.
We discussed our candidate architecture for a scalable shielded native KAS protocol, using covenants, ZK proofs, permissionless relayers and batchers.
One of the biggest takeaways was how much of the infrastructure we're looking for may already be available through Kaspa's Based Apps and KIP-21.
In our original design, one of the challenges was ensuring that batchers couldn't selectively omit user operations while claiming to have processed a complete batch.
With Based Apps, user operations can be ordered directly on Kaspa L1 in an application-specific lane. KIP-21 provides cryptographic sequencing commitments, allowing a properly designed settlement proof to demonstrate that the relevant operations were processed correctly.
That could remove a substantial amount of custom infrastructure we'd otherwise have to build ourselves.
We also discussed canonical bridges, recursive proving and why sharding may introduce unnecessary complexity at this stage.
Our next step is a small Based App feasibility PoC on TN10.
We'll test lane ordering, execution, proof-based settlement, deliberate transaction omission and independent reconstruction before adding the actual shielded privacy logic.
No architecture has been finalized. The goal remains to find the safest, most scalable and most decentralized solution, not to defend an earlier design.
Really appreciate Michael taking the time to share his insights. Conversations like these are incredibly valuable.
Technical feedback, criticism and contributions are very welcome!
github.com/olafweller/kaspa-…
you’re doing good and valuable work. godspeed
Had a really interesting conversation with Kaspa core developer @michaelsuttonil about the Kaspa Privacy Initiative today.
We discussed our candidate architecture for a scalable shielded native KAS protocol, using covenants, ZK proofs, permissionless relayers and batchers.
One of the biggest takeaways was how much of the infrastructure we're looking for may already be available through Kaspa's Based Apps and KIP-21.
In our original design, one of the challenges was ensuring that batchers couldn't selectively omit user operations while claiming to have processed a complete batch.
With Based Apps, user operations can be ordered directly on Kaspa L1 in an application-specific lane. KIP-21 provides cryptographic sequencing commitments, allowing a properly designed settlement proof to demonstrate that the relevant operations were processed correctly.
That could remove a substantial amount of custom infrastructure we'd otherwise have to build ourselves.
We also discussed canonical bridges, recursive proving and why sharding may introduce unnecessary complexity at this stage.
Our next step is a small Based App feasibility PoC on TN10.
We'll test lane ordering, execution, proof-based settlement, deliberate transaction omission and independent reconstruction before adding the actual shielded privacy logic.
No architecture has been finalized. The goal remains to find the safest, most scalable and most decentralized solution, not to defend an earlier design.
Really appreciate Michael taking the time to share his insights. Conversations like these are incredibly valuable.
Technical feedback, criticism and contributions are very welcome!
github.com/olafweller/kaspa-…
i have a feeling this is going to be an interesting read
I finally wrote a book that covers vprogs, and in particular tic-tac-toe implemented as a vprog on testnet-10. It follows the game down to the machinery underneath, with diagrams and appendices for the details. Welcome to explore it and ask questions: biryukovmaxim.github.io/vpro…
Michael Sutton retweeted
Replying to @kaspaunchained
kaspa is programmable high-frequency proof of work.
i think high frequency is all the rage so to speak. it makes it a continuous composition of highly responsive mini programs
Getting closer to this important milestone
The reference app has a simple public minting policy, with a minter frontier of UTXOs (/actors) that can expand and contract with demand.
There’s also a token seed frontier that can expand and contract, and only creates zero-balance token UTXOs. Expanding the frontier requires opting in and locking a small amount of KAS, which can later be reclaimed.
This lets anyone enter the token covenant without already holding any token value. E.g., you create a zero-balance token UTXO from the seed using your own KAS, and others can later borrow-send you token amounts without having to contribute any KAS themselves.
We envision this reference repo as the first step towards a general standardized Kaspa Token Lib (KTL), or more broadly, also non token contracts and libs.
Let’s go
KCC-20 has advanced to Last Call:
github.com/kaspanet/kccs/blo…
A companion reference implementation by @manyfest_, written in Argent together with its pinned generated Silverscript, underwent an extensive manual review and AI-assisted audit by Michael Sutton, covering KCC-20 conformance, implementation correctness, and edge cases.
It is now open for final public battle testing. We encourage developers and security-minded reviewers to try to break it, probe edge cases, and report any implementation bugs or discrepancies with the spec.
Argent contracts:
github.com/argent-lang/kcc20…
Generated Silverscript:
github.com/argent-lang/kcc20…
Michael Sutton retweeted
KCC-20 has officially moved to Last Call status.
Developing software and developing standards are very different.
Software aims to solve a specific problem. A standard aims to define a general foundation for a wide class of solutions.
A special thanks to @michaelsuttonil , who was there from the start to finish , guided me in how to approach this complex craft.
i think the single differentiating concept is indeed, as many have pointed out, one of “forgery” / “lineage” / “provenance”
a more formal definition might be:
i’ve written about it in the past but i feel like now it would hit more ears so to speak.
there are basically two categories of covenants, those that are all about the Kaspa they protect (eg vaults, timelocks, escrow etc) and those that are about the state they carry which essentially forms another mini social consensus (eg name services, native kcc20 tokens, and whatnot). one might typically call these stateful covenants but that’s not the full story
instead of diving straight in, i’d like to hear from you. how do you understand the difference between the two categories, conceptually as well as what are the technical implications resulting from the differences
the need for lineage is both for forming a closed system of rules over this additional state, as well as providing an identity anchor around which social consensus can gather
we have a whole new class of entrepreneurs nowadays. ppl who are passionate about technology but until now did not have enough technical intuition and understanding for actual entrepreneurship.
llms on the other hand are brilliant when guided correctly, but without proper guidance lose the plot
it is critical to bridge this gap and give more and more passionate ppl enough knowledge for guiding llms correctly
i’ve written about it in the past but i feel like now it would hit more ears so to speak.
there are basically two categories of covenants, those that are all about the Kaspa they protect (eg vaults, timelocks, escrow etc) and those that are about the state they carry which essentially forms another mini social consensus (eg name services, native kcc20 tokens, and whatnot). one might typically call these stateful covenants but that’s not the full story
instead of diving straight in, i’d like to hear from you. how do you understand the difference between the two categories, conceptually as well as what are the technical implications resulting from the differences
i’ve written about it in the past but i feel like now it would hit more ears so to speak.
there are basically two categories of covenants, those that are all about the Kaspa they protect (eg vaults, timelocks, escrow etc) and those that are about the state they carry which essentially forms another mini social consensus (eg name services, native kcc20 tokens, and whatnot). one might typically call these stateful covenants but that’s not the full story
instead of diving straight in, i’d like to hear from you. how do you understand the difference between the two categories, conceptually as well as what are the technical implications resulting from the differences
argent now has a first implementation of covenant genesis proofs:
github.com/argent-lang/argen…
idk how to emphasize this enough, but i expect *every stateful covenant* deployed on kaspa to eventually provide such a proof.
the goal is a verifiable link from a covenant id back to the source code, deployment parameters, and genesis state that produced it.
we should strive for an ecosystem where explorers expose this proof data for every covenant id they discover onchain, assuming its deployers want public trust.
think of it as the analogue of contract verification on etherscan, extended to stateful covenants: you should be able to inspect what a covenant is, audit the code behind it, and verify how it was instantiated.
kudos to @supertypo_kas for being an early-bird example of such a proper deployment process:
github.com/supertypo/dotk-in… (not sure if the sil contracts themselves are public yet)
Michael Sutton retweeted
Replying to @KrexToken
Transition of KCC-20 to Last Call is pending peer review of the KCC-20 reference implementation, which is the final milestone in the KCC process. This is expected in the coming days.
huge honor but I’m also nervous ngl











