THE WORLDDOESN’T NEEDTO KNOW.

Every payment between users is shielded: sender, receiver and amount are hidden, with no transparent mode. Halo 2 zero-knowledge proofs, also used by Zcash, require no trusted setup. Anonymity is within the current pool generation.

Value lives in encrypted notes. Spending reveals a nullifier that prevents double spends without identifying the note. A proof made on your device shows that the notes exist, the amounts balance and the owner approved.

Dummy actions pad every transaction to exactly 2, 4 or 8 actions, so size shows only which of the three a payment used. Received funds become spendable after about 10 to 20 minutes; this is distinct from 12-hour finality.

Uniform fee tiers, not a bidding war.

Every transaction pays the same public per-action fee as its neighbours, with no tips or bidding, so fees show nothing beyond the transaction’s size. Once an hour the fee can move one tier, about 19%, with demand, while the previous tier stays valid.

The working initial fee is 0.0001 TFN per action (10,000 rivets): half is burned and half goes to the miner. Fees are not final.

Public by design: mining-reward addresses and amounts, and stablecoin conversion amounts. Later spending of mining rewards is private. No master key can reveal users or freeze their funds.

TitanForge builds from established open-source parts: Kaspa’s GHOSTDAG, Zcash’s Orchard (Ironwood), XELIS’s XelisHash and the Djed design.

Parallel blocks. One order.

The design targets one block per second, each referencing up to ten earlier blocks. GHOSTDAG puts all blocks, including parallel ones, into one order along the heaviest line of work.

The working block limit is 250 KB, about 27 payments per second. Blocks are final after 12 hours. Block size is not final; one-second blocks do not mean one-second finality.

CPU and GPU proof of work.

XelisHash-TF is a variant of XelisHash v3 with its own keys. Difficulty adjusts every block using roughly the last 44 minutes of blocks. It can rise only gradually, preventing an attacker from packing a chain’s weight into a few unusually heavy blocks; decreases have no limit. Whether part of the mainnet reward is paid through a RandomX share path, with total emission unchanged, is still undecided.

• Free, open-source CPU and GPU miners, with a mining specification, before launch.
• Pool software and an integration kit any pool can adopt, using a Stratum dialect and shielded payouts.
• At least three independent pools on the public testnet before mainnet.

How rewards are paid.

The network creates reward notes when a later block merges the block that earned them, paying rewards and fee shares to each well-connected block’s miner. A late, poorly connected block’s reward goes to the miner whose block merges it.

Reward addresses and amounts are public. Miners should use a separate, regularly changed reward address.

Nothing mined in advance. mainnet

Every coin comes from block rewards. Newly issued coins go to miners, except 5% that goes to the development fund for the first four years. The genesis block will prove nothing was mined in advance.

Command-line, desktop and web wallets are planned for the public testnet, with a daemon for exchanges. A mobile wallet with private light sync follows later. Keys never leave your device. No wallet is available to download yet.

One phrase. Unlinkable addresses.

A wallet restores from 24 words and gives out unlimited unlinkable addresses beginning tf1 on mainnet and tftest1 on the test network, found by one key and valid for every asset.

An incoming viewing key reveals received payments. A full viewing key also reveals spends and outgoing payments. Neither can spend. A payment proof reveals one payment without sharing a viewing key.

Private sync without sharing keys.

New nodes sync a compact proof of history and the current shielded state, checking both against the proof-of-work chain. Full nodes retain full blocks for 30 to 42 hours, spent-note records forever, and a compact archive that wallets scan themselves. Wallets never send keys or addresses to a node.

A wallet offline for a week can catch up from any node.

Encrypted transport. Dandelion++ relay.

Not built yet: test builds today connect in plain text, so treat them as not private. When built, node traffic uses padded TLS 1.3 transport. Dandelion++ sends a new transaction along a short random path before broadcast. A transaction cannot be tied to an IP address by ordinary peers.

Your internet provider can still see that you run a node and may tell when you send. Use Tor or a VPN if that matters. Encrypted mempools and a mixnet are later upgrades, not current guarantees.

Public issuance. Hidden balances.

Every block header commits to each pool’s balance and coins issued and burned. Nodes halt with an alarm if the supply fails to add up. A turnstile lets value leave a pool only up to what entered it, and an open auditor rechecks everything from the first block.

Totals cannot reveal a counterfeit hidden inside a pool. Independent audits and a plan to seal and replace a pool reduce that risk; public totals are not a complete cryptographic safety guarantee.

Recoverable does not mean quantum-safe.

Today’s elliptic-curve private-payment cryptography could be broken by a large quantum computer, which would also expose recorded payments.

Every note standard wallets create or accept is quantum-recoverable from the first block under ZIP 2005. Owners should be able to prove ownership by quantum-safe means and move their funds, but the recovery protocol is still being specified. TitanForge is not quantum-safe; a fully quantum-safe pool is planned for later.

Checkpoints for the early months. mainnet

For the first six months, signed node releases carry known-good checkpoints at least 12 hours deep. These protect new or long-offline nodes against fake histories built with rented hashpower. A node whose own history disagrees halts and alerts its operator. After six months, checkpoints switch off for good.

Upgrades without a rule-changing key.

There is no on-chain vote or key that changes the rules. Changes ship as signed node releases activating at a set block, only on nodes that run them.

A pool reaching its size limit is sealed with 14 days’ notice and replaced. After a cryptography bug, signed releases can pause and repair a pool, but never move, cancel or create coins.

Emission begins at 1 TFN per second and halves every two years, in monthly steps rather than abrupt cuts. After about 10.2 years, a permanent tail of 0.03 TFN per second keeps paying miners.

The tail is about 1% at first, falling as a percentage each year. There is no hard supply cap.

Development funding in the open.

The development fund receives 5% of newly issued coins for the first four years, about 3.46 million TFN, under 4% of the supply after ten years. Then it receives nothing, and it never takes transaction fees. Development funds go to an address whose viewing key is public, so anyone can follow what it receives and spends.

A payment feature, not a yield product. Following the Djed design, Tungsten (TGN) tracks the dollar and Girder (GIRD) is its reserve share, both backed by TFN held by the protocol itself, not a company, bank or key. Built, audited and tested before mainnet, Tungsten is off at launch.

Over-collateralised, not guaranteed.

Working limits allow new Tungsten only while the reserve is worth at least 500% of the Tungsten in circulation. Girder owns the surplus and absorbs TFN’s price swings; it can be bought only up to 1,000% and redeemed only down to 500%.

Tungsten is redeemable whenever a valid price exists, pro rata while the reserve is below 100%. A reserve at 500% stays fully backed through an 80% fall in TFN, but 500% is a minting limit, not a floor. A 2% conversion fee stays in the reserve. There is no yield token.

Private participants. Public conversion amounts.

A shielded request hands over its input and specifies fresh result and refund addresses. Minutes later the protocol settles it using a price set after the request, creating a new shielded note. Conversions in the same block share the same prices, each the least favourable to the converter of three prices: the epoch price, a 24-hour median and the unclamped oracle median.

Conversion amounts are public; amounts paid in must use standard values (1, 2 or 5 times a power of ten), but who converts is private. Reserve, supplies and pending requests are committed in every block. Each coin has its own shielded pool.

The oracle and its limits.

Nine independent, publicly identified operators each sign a TFN/USD price from at least three exchanges every two minutes. The chain takes the lower median of at least five fresh prices, moving at most 2% per period.

If prices look wrong, only rate-limited redemption remains open; without five operators, conversions pause. Operators cannot create coins, move funds or change rules, but five acting together could set a false price. The 2% limit, redemption-only mode, hourly caps and supply cap limit the damage.

The dollar value is a target, not a guarantee. In a fast crash, redemptions can return less than a dollar’s worth.

Build it. Test it. Audit it. Then launch.

1. SpecificationIn review

   Written; review continues.

2. Core node & development networkBuilt

   Tested across several machines.

3. Private transactions & supply auditorBuilt

   Private payments work end to end; the auditor’s run on a live chain is still to come.

4. Open CPU & GPU minersIn progress

   Reference CPU miner built; a GPU miner is to follow. Benchmarks, sync and network privacy.

5. Wallets & pool softwareIn progress

   Command-line wallet built and tested end to end. Next, a development network run by several operators.

6. Public testnetMilestone

   Tungsten follows on a test network before mainnet.

7. Independent security auditsRequired
8. Mainnet launchAfter audits

   Signed, reproducible releases. Tungsten ready, but off.

9. After mainnetLater

   Mobile wallet, Tungsten activation once criteria are met, and privacy upgrades.