A crowd of walkers on a curve, paid the moment two of them collide.
RhoWalkers is a mining pool for cryptanalysis. Anyone with a GPU runs Pollard rho against a public elliptic-curve challenge, every unit of verified work mints one credit, and the prize is split once, pro rata, when the round is solved.
Why nobody has done this
The trust cliff
Whoever coordinates sees the collision first and holds the key. Volunteers have no reason to believe they will be paid, so they never show up.
Cheating is free
A distinguished point is 24 bytes. Forging one costs nothing unless someone replays the walk that produced it, and nobody has been replaying.
Paid only at the end
A round can run for months. Whoever leaves early has historically gotten nothing, so the crowd thins exactly when it is needed.
How it works
One unit of work, one credit
A distinguished point with w trailing zero bits stands for 2w expected steps. One credit is 230 verified steps. No block reward, no halving, no treasury, no vote.
Nobody issues seeds
A walker starts at PRF(round, pubkey, t). Anyone can recompute any walk from public data, so the coordinator keeps no per-miner state and an auditor can re-verify offline.
Admission is the same kernel
A ticket is a walk until x has d trailing zero bits. Seconds on a weak device, replayed once, and no edge for botnets or ASICs over an honest GPU.
Replay, not proof
A deterministic 1 in N segments are walked again from their start. A forger cannot know which. One failure slashes the identity. This beats proving every step by a factor of 105.
Pull-based settlement
Each epoch the coordinator posts one Merkle root of (address, credited steps) to a vault on an Ethereum L2. After the solve, every miner sends one claim(steps, proof).
Refund on abort
External solve, timeout, or coordinator silence returns the pre-funded pool to its depositor. Credits stay recorded; nobody's work is silently repriced.
The MVP, end to end
Everything above runs today in Python on toy curves. A 56-bit round on one laptop: three honest miners with 3, 2 and 1 processes, one cheater submitting real-looking points with invented coefficients.
| Expected work | 3.1e8 steps (1.25·√n) |
|---|---|
| Solved after | 74% of expected, about 100 seconds, k verified against the generator's secret |
| Payouts | 46.2% / 35.2% / 18.6% |
| Cheater | slashed on the first replayed segment, credits zeroed, key blocked |
| Replays | 191 of 14,060 segments (1 in 64), 0 false positives |
| Ledger | 7 epoch roots; proofs verify in Python and inside the Solidity vault |
The coordinator dashboard after the round above.
python3 -m venv .venv && .venv/bin/pip install fastapi 'uvicorn[standard]' cryptography httpx ./demo.sh # 56-bit round, coordinator, 3 honest miners + 1 cheater open http://127.0.0.1:8642 # dashboard
The ladder
| Target | Steps | Prize | 1,000 RTX 5090 | Status |
|---|---|---|---|---|
| Certicom ECCp-109 | 2.3e16 | solved 2002 | minutes | calibration rerun |
| Certicom ECCp-131 | 4.5e19 | $20,000, open since 1997 | ~18 days | first public round |
| Bitcoin puzzle #135 | 1.8e20 | 13.5 BTC, bearer | ~70 days | needs threshold solve |
| Certicom ECCp-163 | 3e24 | $30,000 | ~13,000 years | out of reach |
Every rung is a rung of the same ladder: same walk, same tickets, same credit, same vault. Solving 131 bits says nothing about P-256; the gap is 262. This is a way to organize a crowd, not a threat to anyone's wallet.
Roadmap
- Pre-mine 60–80 bit rounds on the MVP to shake out the protocol.now
- GPU kernel for the 131-bit field with negation map and look-ahead. Gate: measured throughput on real hardware.
- ECCp-109 rerun, closed then open, to calibrate quotas, replay rate and epoch length.
- ECCp-131 with a USDC pool in the vault plus the Certicom prize claimed by a legal entity and distributed through the same root.
- v2 coordinator: staked committee, each member running its own intake bucket.
- Puzzle #135 only when the collision can be resolved without any single party learning k first.