CANON f. 1r

CANON

Canon tables of the cryptographic world computer

  1. IWorkSatoshi's proof of work, byte for byte
  2. IIStakeBLS validators, Casper finality, the Merge
  3. IIILeanHegota, then only quantum-safe votes

Ethereum is called a blockchain for historical reasons. CANON is that history, executed.

A Uniswap v4 pool run as a chain. It opens as Bitcoin in 2009 and lives through every transition Ethereum has made or plans to make, on the same cryptography, checked on mainnet, with the market deciding when each fork arrives.

Begin at the canon tables

Incipit

Here begins the canon

f. 1v

In September 2026, Vitalik Buterin went back to Bitcoin's whitepaper and walked it section by section, marking what Ethereum had changed by 2015 and 2025, and what it will have changed by 2030. His conclusion: nearly everything that once defined a blockchain has been replaced, or soon will be, by cryptography that was not ready in 2009. What is left is called a blockchain largely for historical reasons.

CANON copies that walk into a Uniswap pool and makes it run. The pool is a chain. It starts with Satoshi's machinery, and each era hands the canon on to newer cryptography: proof of work, then BLS signatures and Casper finality, then hash-based keys built to outlast quantum computers. No date moves it forward. Deposits, hashpower and keys do.

Everything on these pages that computes, computes for real, in your browser: SHA-256, Keccak, BLS12-381, Winternitz. The pool itself is not open yet, so the chain you will see is a demonstration, hashed exactly the way the contracts hash it.

Canones

The canon tables

f. 2r

Gospel books opened with canon tables: arcades of columns setting parallel passages side by side. Vitalik's post is one. These are its rows, with CANON's three eras for columns.

MMIXSatoshi, 2009 IWork IIStake IIILean
The canonical chain the longest proof of work Satoshi's SHA-256d, in Bitcoin's own header Casper: two thirds of the validators final in the epoch it is justified
Authorization one ECDSA signature Ethereum's signature on every swap BLS12-381, many added into one one-time hash-based signatures
Inclusion mempool, miner, block one CANON block per Ethereum block that trades votes gossiped as logs, aggregated by anyone every vote checked on its own
Ordering the miner's choice in every era, no trade beats the price its block opened at
Storage prune old transactions one 32-byte head; history in the logs a checkpoint every 6.4 hours a Merkle root per validator
Light clients trust the longest chain headers and their work one pairing checks a finalized checkpoint one path to a Merkle root
Cryptography SHA-256 · ECDSA SHA-256d · Keccak-256 + BLS12-381 pairings · RFC 9380 + Winternitz chains · Merkle trees

Rotulus

The pool is a chain

Bitcoin §2 Transactions · §3 Timestamp server · §7 Reclaiming disk space

f. 2v

MMIXHash a block of items together with the previous block's hash, and publish it widely. Once enough blocks are stacked on a transaction, prune it; keep the root.

Every swap is a transaction. Every Ethereum block that trades becomes a CANON block, sealed into a hash chain the moment the next one begins. The contract keeps a single head and no history at all: the history lives in the logs, and it all hashes into the head. At the first touch of every 6.4-hour epoch the head is written down as a checkpoint, the thing miners timestamp and validators finalize.

    A demonstration chain, generated and hashed in your browser the way the hook hashes it: keccak(BLOCK, parent, height, block, time, txCount, txRoot, open, close). Select a block to read it. Epochs here pass in twelve seconds; on the pool they last 6.4 hours.

    Select a block on the roll.

    Opus

    I Work

    Bitcoin §4 Proof-of-work · §6 Incentive

    f. 3r

    MMIXScan for a nonce until the block's hash begins with enough zero bits, and let the difficulty follow the rate at which blocks are found.

    Exactly that, byte for byte. A block of work is an 80-byte Bitcoin header, hashed twice with SHA-256 and read little-endian against a target. Its merkle root commits to a coinbase that names the pool's chain, the height and the miner who is paid. Ethereum checks each one with its SHA-256 precompile and pays the miner the fees the pool has collected since the last block.

    version401000000
    previous block320000000000000000000000000000000000000000000000000000000000000000
    merkle root323ba3edfd7a7b12b27ac72c3e67768f617fc81bc3888a51323a9fb8aa4b1e5e4a
    time429ab5f49
    bits4ffff001d
    nonce41dac2b7c
    sha256d, read little-endian 000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f

    Bitcoin's genesis block, as its 80 bytes are laid out. Its coinbase carries a headline: The Times 03/Jan/2009 Chancellor on brink of second bailout for banks.

    The search runs at 220, a demonstration difficulty; the contract opens at 232.

      Sigilla

      II Stake

      Bitcoin §5 Network · §9 Combining and splitting value · §11 Calculations

      f. 3v

      MMIXNodes accept the longest chain, and an attacker's chance of catching up falls with every block stacked on top.

      32,000 CANON and a BLS12-381 key make a validator. Once per epoch each signs a single Casper vote. The signatures are posted as logs, stripped off, added into one, and checked with a single pairing. Two thirds justify a checkpoint; a justified child finalizes its parent. Finality stops being a probability, and breaking it costs a third of the stake: two conflicting votes from one key burn half of that validator's deposit.

      I vote that checkpoint 1 0x… follows checkpoint 0 0x….

      signing root 0x…

      0 of 16 signed · two thirds is 11

      one signature for all of them (none yet)

      Select a seal to sign, or sign them all.

      Sixteen real BLS12-381 keys, made in your browser. Each seal signs the vote above; the signatures add into one. The contract checks all of them with a single pairing.

      Kalendarium

      The red-letter days

      f. 4r

      Books of Hours wrote their feasts in red. CANON's feasts are its forks, and none of them has a date. Each arrives when its condition is met.

      1. 0FrontierThe pool opens. Miners work; the deposit contract accepts validators.
      2. E+1Beacon genesisOne epoch after the sixty-fourth deposit. Validators vote beside the miners, and the pool's ether is split between them.
      3. TTDThe MergeWhen the miners' work reaches the terminal total difficulty, one week of work after beacon genesis, or when the difficulty bomb goes off sixty days after the pool opened. Mining ends, for good.
      4. M+16ShapellaSixteen epochs after the Merge, stake that has exited can be withdrawn.
      5. M+64HegotaThe last normal fork. Sixty-four epochs after the Merge, once two thirds of the validators hold hash-based keys.
      6. H+1LeanFrom the next epoch only hash-based votes count, and a justified checkpoint is final at once.

      Scala

      III Lean

      Bitcoin §12 Conclusion

      f. 4v

      MMIXA system for electronic transactions without relying on trust.

      Vitalik expects Hegota to be Ethereum's last normal fork; after it come recursive STARKs, optimized consensus and quantum safety. In CANON, once two thirds of the validators have registered a hash-based key, BLS stops counting. Every vote becomes a one-time Winternitz signature under a Merkle root, trusting nothing but the hash, and a checkpoint is final in the epoch it is justified.

      One-time key 1 of 8 signs the vote 0x…

      Each gold mark is a secret revealed partway up its chain. A verifier walks every chain to its top.

      Regula

      XIII Ordering is priced

      The section Satoshi did not write

      f. 5r

      Vitalik's advice to builders: in the architectures to come, ordering is what costs. In a pool, two swaps in the same direction commute; in either order the pool ends at the same price. A swap that reverses a move made earlier in its own block does not, and it is the only kind of trade that can profit from its place in the block.

      So CANON rules a line at the price each block opened at, and no trade is written above it. Whatever a trade would have gained beyond the rule, the pool keeps. An honest trader who happens to go the other way in a busy block still receives at least the price quoted when the block began. A sandwich's back leg receives no more than the price before its own front leg.

      A constant-product stand-in for the pool: 10 ETH against 36 million CANON, a 1% LP fee, and CANON's 1% toll. The ordering charge is computed with the same formula the hook uses.

      De moneta

      Of the token

      f. 5v

      72,009,990.5

      CANON, the ether that existed in Ethereum's genesis block. Minted once, to one address. No owner, no mint, no pause, no blacklist, no fee switch, no proxy.

      The toll
      1% of every swap, on the side the router did not pin.
      Buyers burn
      Most buys pay the toll in CANON, and it is burned.
      Sellers pay consensus
      Most sells pay in ether: to miners, then validators, released as epochs become final.
      The stake
      32,000 CANON per validator, up to 1,024.
      Slashing
      Half the stake burned; a sixteenth to whoever proves it.
      Absence
      Sixteen silent epochs and anyone may eject a validator, for a sixty-fourth of its stake.

      Colophon

      Collated against

      f. 6r
      1. RFC 9380's own vectors for hashing to the curve, in Solidity, and in a second implementation in JavaScript that also matches mainnet's MAP_FP2_TO_G2 precompile byte for byte.
      2. Five of Ethereum's validators. Deposit signatures from blocks 26,067,560 to 26,067,941, verified by CANON's contract over the beacon chain's own signing roots.
      3. Bitcoin's genesis block, 000000000019d6689c…8ce26f, hashed on the EVM from its 80 bytes.
      4. Two hands for every text. Keys, signatures, proofs of possession, one-time keys, mined headers and calldata, written in JavaScript, accepted by the contracts, and byte-identical to what the precompiles compute.
      5. A live node. Sixty-four validators made and run with CANON's own tool, their gossiped votes added into one pairing, an epoch justified; a block mined and accepted.
      6. Sixty-six tests on a mainnet fork, through the real PoolManager and Universal Router.

      What this codex is not

      • The consensus does not secure the trades; Ethereum does. What it decides is the finality of the pool's own history, and who is paid for it.
      • It pays what trading pays. Nothing is minted, ever.
      • Stake deposited before the Merge waits for Shapella. If the beacon chain never starts, deposits refund.
      • Hash-based votes are expensive. That is the point of the third era, and also its cost.

      The four columns of the frontispiece are woven from real data, one bit to a square: Bitcoin's genesis hash · RFC 9380's hash of abc · the key of the Ethereum validator who deposited at block 26,067,560 · CANON's attestation tag. The letters are set in Jacquard, a blackletter drawn on a loom's grid.

      …weaves algebraic patterns just as the Jacquard loom weaves flowers and leaves.

      Ada Lovelace, on the Analytical Engine, 1843

      Explicit