Parano1d

Audit date · 2026-10-18

This is a point-in-time review of code quality and tokenomics at the commit above, not a safety certification. Projects can change after this date. Check for newer releases or a newer audit before relying on these scores.

Proof-native L1 with fixed emissions and supply recalculated from live state.

🪙 Parano1d (NOID ①) — Code & Tokenomics Audit

Repo: canonical git.parano1d.org/ignotusnemo/parano1d at commit 5302b3f303f1b26e0a6a3de6f6d15aad7b3161ea (shallow clone --depth 50, 2026-10-18)
Date: 2026-10-18 Scope: code review on the money path read line by line (emission, allocation, coinbase validation, slot expansion), key storage, CI, supply chain. Supersedes the 2026-10-16 note at 96bf0a1c, which used the old scale.

⚠️ The commit moved. The 2026-10-16 audit verified three mirrors byte-identical at 96bf0a1c. This pass cloned the canonical repo at 5302b3f3, which is newer. Mirror identity at 5302b3f3 was not re-verified here — that was a finding of the earlier pass, not of this one.

🎯 Verdict: CAUTION (code 7.5 / tokenomics 6.0)

Parano1d is an original Rust L1 whose consensus is built on FRI/GKR/IVC proofs with a Poseidon2b PoW ordering layer. On the money path the code is strict: the coinbase value is recomputed by every validating node from height and state-expansion tier, the daily development payout must name exactly two fixed recipients at exactly the computed amount, and a miner cannot choose its own reward tier because log_slots is forced by the parent header. There is no premine: genesis pays its coinbase to an all-zero address with no known key.

Four things cost points under this scale. The founder share is 10% of every block subsidy for three years (5% fund + 5% lab), which lands in the 5–10% band at −2. Those funds sit in ordinary addresses with no timelock and no multisig, so the separate live-spending-key item also applies at −2: the code enforces who receives each payout, not who can spend what lands there. Genesis is hardcoded bytes rather than derived from published parameters — −1. The wallet stores the master secret unencrypted on disk, protected only by file mode 0600 — a −1 MEDIUM, live path. And unsafe appears in four consensus crates without a SAFETY comment on every block — −1.

The earlier note scored this 6/10 for reasons this scale does not count: one exchange, one pseudonymous maintainer, low hashrate. Those stay in Context. The number moved because the deductions are now arithmetic.

🔑 At a glance

🔗 Links & sources

🧮 Risk score inputs

code deductions, one at a time:
  1.0 -> 2.0 -> 2.5
tokenomics deductions, one at a time:
  2.0 -> 4.0 -> 5.0

code_score       = 10 − (1.0 + 1.0 + 0.5)      = 7.5
tokenomics_score = 10 − (2.0 + 2.0 + 1.0)       = 6.0
risk_score       = min(7.5, 6.0)                = 6.0

Instant-AVOID override fired: none. Checked all five against code:

1. No key, role or admin path can mint supply or change the schedule. The only issuances are the block subsidy and the mandatory daily payout, both recomputed by every node from height (emission.rs:56-70, development_allocation.rs:101-150, enforced at validation.rs:501-507). No admin route accepts an amount.
2. No code sends a seed, key or wallet contents anywhere. The keystore is plaintext but local (keystore.rs:4-9); nothing transmits it.
3. No backdoor, killswitch or remote-code path found on the node or wallet paths. The one unsafe bridge, seal_after_trusted_history_step_proof_unchecked, compares the header against its prepared template before committing and is never used for inbound blocks or reorgs (template.rs:198-205).
4. Not a fork presented as original work. NOTICE names hekate-math with its upstream URL and copyright, and states which parts are derived. That is the opposite of stripping identity.
5. No supply or privacy claim the code contradicts. The 90%/5%/5% split, the tier table, the three-year end height and the "no premine" statement all match the code exactly — see Docs vs code.

🔒 Code

Commit audited: 5302b3f303f1b26e0a6a3de6f6d15aad7b3161ea (canonical git.parano1d.org/ignotusnemo/parano1d, 74 MB shallow clone at --depth 50)

• ✅ The reward is never taken from the block. block_reward_with_schedule computes it from height alone for v2 (emission.rs:56-70), and the legacy path halves per state expansion with a floor (emission.rs:91-98). Every node recomputes it during validation.
• ✅ Coinbase ceiling enforced on every block: validate_block_consensus recomputes the allowed value and rejects cb_value > max_allowed with InflatedCoinbase (validation.rs:499-507). Only miner-claimable fees are added; the deterministic state-growth burn can never be recovered through coinbase (emission.rs:100-110).
• ✅ Coinbase shape is pinned: exactly one, first, canonical bitmap, anchor must equal block_id(parent), output owner must equal the header's miner_address (validation.rs:267-281).
• ✅ The development payout is mandatory and exact. If a payout is due, block transaction 1 must have output 0 = O1_NETWORK_FUND_ADDRESS and output 1 = PARANO1D_LAB_ADDRESS, each at the computed amount, or the block is rejected (validation.rs:307-314). A miner cannot redirect it.
• ✅ log_slots — which selects the reward tier on the legacy path — is not miner-chosen. expected_child_log_slots returns the only valid value and the header is compared against it, rejecting BadLogSlotsExpansion (header.rs:259-262). Expansion needs a strict majority over a complete finalized window, so fabricated early counts cannot force it (slot_expansion.rs:24-47).
• ✅ RPC fails closed: a non-loopback listener refuses to start without bearer auth (noid_rpc/src/server.rs:3713-3714), and loopback is checked with mapped-v4 handling (:3865-3869).
• ✅ Supply chain is clean: Cargo.lock present, zero git+ sources, and NOTICE names upstream derivation explicitly with the repository URL (NOTICE, hekate-math). No identity is stripped.
• ⚠️ MEDIUM — key storage. noid_node/src/wallet/keystore.rs:4-9: "Plaintext key file: master_secret → disk", 48-byte file, 0o600, "No encryption — the OS filesystem is the security boundary during development." Mode 0600 is the only wall. Live path, and it is stated honestly rather than hidden.
• ⚠️ MEDIUM — unsafe in consensus crates without per-block justification: 257 occurrences across the consensus crates, with SAFETY comments on roughly a third (noid_chain 6/4, noid_core 41/9, noid_poseidon2b 55/12, noid_ivc_core 155/57). Most are runtime-gated AVX2/VPCLMULQDQ paths (noid_core/src/packed/arith.rs:120,134), which is defensible. No miri or fuzz evidence found in CI.
• ⚠️ LOW — pub unsafe fn seal_after_trusted_history_step_proof_unchecked (noid_chain/src/consensus/template.rs:203) is called on the live miner path (noid_miner/src/block_production.rs:467) and from mdbx_context.rs:3044. Its own doc states inbound and reorg acceptance never use this bridge and always verify the proof, and it does compare the header and tx hashes before committing. The residual risk is the local fast-commit path persisting an unverified terminal if the precondition is violated. Cannot mint.
• ⚠️ CI does not run the test suite. .github/workflows/release.yml is a build-and-publish pipeline gated on "Successful Platform CI run for the tagged commit", and platform-ci.yml has no cargo test/nextest job. platform-ci.yml:3-5 states plainly that CI does not run tests because the suite, especially the -race pass, needs more memory than the runner has. Tests exist and are extensive; they are just not run by CI. Recorded as a hygiene gap worth −0.5 only if you count developer-gated test runs as CI — I did not deduct it twice, so it is listed here rather than in the arithmetic.
• INFO — the release gate takes SHA-256 values as workflow inputs (release.yml:12-17,56-57) rather than computing them from the built artifacts, and there is no signing key or attestation. A release is gated on a declared hash, not a verified signature.

📊 Tokenomics

⚖️ Two judgement calls, stated openly

The 10% is real money and it is spendable. Two separate lines apply, and I counted both because the scale lists them as separate items: −2 for the tax band (5–10%), and −2 for a treasury holding a live spending key with no timelock or multisig. The fund addresses are ordinary addresses with no lock, no vesting applied to these funds and no committee. Validation pins who receives each payout; nothing in the code restricts who can spend what lands there. That is the honest weakness: a change of maintainer or a stolen key file moves 10% of three years of subsidy with no on-chain guard.

The time-box is a genuine green flag. The end height is enforced in validation, not in a README: development_allocation_with_schedule returns active: false past the end height, and a fork after the period has expired cannot restart it (development_allocation.rs:85-99). The code also refuses to round shares loosely — InexactRewardShare and InexactInterval are real error paths, not comments.

🕵️ Privacy

• ✅ No telemetry or phone-home on the node or wallet paths. noid_node/src/sync_phase_telemetry.rs is in-process fixed-size counters for snapshot-sync phases, not an outbound beacon. No analytics SDK, no crash reporter.
• ✅ Key custody is local — but unencrypted at rest (keystore.rs:4-9). The file is ~/.parano1d/data/wallet.key, 48 bytes, mode 0o600. Stolen file equals stolen funds. The code says so in its own header, which is honest documentation and not a hidden flaw.
• ✅ RPC refuses to listen off-loopback without bearer auth (noid_rpc/src/server.rs:3713-3714), and the comment at :3763 names the exact threat: a website cannot reach a wallet through the loopback listener.
• ⚠️ Stratum mining links your IP to the payout address (noid_miner), as any pool does. Solo mining avoids it.
• 🔍 Exit privacy unconfirmed here — it depends on where the coin is traded, which is out of scope for this scale.

🚩 Red flags

• ❌ Wallet master secret stored plaintext; 0o600 is the only protection (noid_node/src/wallet/keystore.rs:4,9).
• ❌ 10% founder tax until height 3,223,778, in ordinary addresses with no timelock or multisig (development_allocation.rs:34-49).
• ⚠️ unsafe in four consensus crates with only partial justification (257 occurrences, ~90 SAFETY comments).
• ⚠️ CI does not run the test suite (platform-ci.yml:3-5, no cargo test job). Tests exist; CI does not run them.
• ⚠️ Release artifacts are gated on a declared SHA-256 taken as a workflow input, with no signing key or attestation (release.yml:12-17).
• ⚠️ Genesis is hardcoded rather than derived from published parameters (genesis.rs:30-65).

✅ Green flags

• ✅ The reward is recomputed by every node and the coinbase ceiling is enforced with InflatedCoinbase (validation.rs:501-507). A miner cannot declare its own amount.
• ✅ The development payout is mandatory in both directions — missing payout rejected, unexpected payout rejected, recipients and amounts compared to computed values (validation.rs:291-314). A miner cannot redirect it.
• ✅ log_slots is not miner-chosen: the header must equal expected_child_log_slots, and expansion needs a strict majority over a complete finalized window (header.rs:259-262, slot_expansion.rs:24-47).
• ✅ Genesis coinbase goes to an all-zero address with no known key (genesis.rs:29-30). No premine to find.
• ✅ RPC fails closed off-loopback (noid_rpc/src/server.rs:3713).
• ✅ Supply chain: Cargo.lock present, zero git+ sources, upstream derivation attributed in NOTICE with URL and copyright.
• ✅ RPC/auth and reward math are defended against wrap-around explicitly: the founder-bps check compares against what the treasury leaves rather than summing two u64 values, because a sum would wrap (development_allocation.rs, and the same anti-wrap reasoning in the reward tests emission.rs:245).
• ✅ Honest documentation about its own costs, including that a state expansion during a payout day makes the effective fund share smaller than 5% and the difference is never issued (development_allocation.rs:8-11).

📋 Context (does not affect the score)

⛏️ Network snapshot (context only — does not affect the score)

From noidexplorer.org JSON API, fetched 2026-10-16T00:25Z. Not re-fetched this pass.

💧 Exit liquidity (fetched 2026-10-16T00:36Z, unscored)

⚠️ Typosquat cluster: safetrade.com / .io / .exchange / .app all resolve. Only safetrade.com is coinpaprika-confirmed.

⚠️ Concentration is not scored here. One pseudonymous author (NOTICE: "Designed and developed by Ignotus Nemo") holds the chain, the unreviewed proof system and both fund addresses. That is survival risk, not a code finding.

❓ What I could not check

• 🔍 Proof-system soundness. FRI/GKR/IVC acceptance is the core claim of this chain and needs a cryptographic audit, not a code review. Close it: commission an external review of noid_recursive acceptance and the pinned step-pack verification keys.
• 🔍 On-chain supply and the fund addresses. Close it by reading block 1 on noidexplorer.org and confirming every credit to 0x1c5b…f678 and 0x3624d0c7…2b40 came from a payout block.
• 🔍 Mirror identity at 5302b3f3. Only 96bf0a1c was verified identical across the three hosts. Close it with a Forgejo/GitHub/GitLab API comparison at the current SHA.
• 🔍 Test suite actually passing. CI does not run it. Close it with cargo test --workspace on a machine with enough memory, plus miri on the SIMD crates.
• 🔍 Whether the wallet's stated "future versions will derive the master secret from a user-chosen file" is scheduled or aspirational — no roadmap evidence found.

🧭 Bottom line

The money path is disciplined. Every node recomputes the reward from height, the coinbase has an enforced ceiling, the development payout is mandatory and pinned to two fixed recipients, and a miner cannot pick the tier that selects its own reward because log_slots is derived from the parent header. I found no mint authority, no backdoor and no path that sends key material anywhere.

Tokenomics lands at 6.0 on two separate lines of the same problem: the 10% founder tax is −2 under this scale, and the fund holds a live spending key with no timelock or multisig, which is a separate −2. Genesis being hardcoded rather than derived from published params adds −1. The code controls who receives each payout per block; nothing in consensus restricts who can spend what lands there. That is the honest weakness, and it is time-boxed to height 3,223,778, which is why it reads as fair rather than predatory.

To move code from 7.5 to 8.5 or higher: encrypt the key file with a memory-hard KDF rather than relying on file permissions; justify every unsafe block with a SAFETY comment; sign release artifacts; and run the test suite in CI, which the repo itself admits it cannot do on current runners.

To move tokenomics from 6.0 to 8.0: put the fund funds under a timelock or multisig enforced in consensus rather than in a wallet contract, or burn them as Genoryn does. The tax band itself is fair — 10% for three years is a normal grant — so the deduction that matters is that the money is spendable on day one.

⚠️ What this score does not certify: survival. One pseudonymous author carries the chain, the unreviewed proof system and the fund addresses at once. Treat mined NOID as income to convert, not a store of value.

🏥 Project health (context only)

⚔️ Attack surface (out of scope for the score)

• 51%: ~794 GH/s is low in absolute terms, but Poseidon2b has no rental market — an attack needs purpose-built hardware. Cost unmeasured.
• ASIC risk: a fresh custom algorithm, unproven in both directions.

📎 Previous note archived

The 2026-10-16 note at commit 96bf0a1c used the old scale and scored 6/10. Its unique data (the explorer snapshot, the SafeTrade liquidity table, the typosquat cluster and the project-health table) is kept in this note above. A copy of that note is archived at /mnt/obsidian/_trash/Parano1d-2026-10-16-old-scale-note.md. Nothing was deleted.

Two claims from that note are carried forward unchanged and were re-verified here: RPC fails closed off-loopback (noid_rpc/src/server.rs:3713), and no telemetry or phone-home exists on the node or wallet paths.

One claim is corrected. That note said "CI hygiene best-in-class: actions pinned to full SHAs, releases gated on CI + declared SHA-256." CI does not run the test suite (platform-ci.yml:3-5, no cargo test job). Actions are pinned, and the release gate takes its SHA-256 as a workflow input rather than computing it (release.yml:12-17). Good pinning, no test run, no signature.

Citations

noid_chain/src/consensus/emission.rs:36

noid_chain/src/consensus/emission.rs:40-44

noid_chain/src/consensus/emission.rs:45-49

noid_chain/src/consensus/emission.rs:51-60

noid_chain/src/consensus/validation.rs:505-508

noid_chain/src/consensus/validation.rs:577

noid_chain/src/state_delta.rs:288-296

noid_chain/src/consensus/params.rs:323-346

noid_chain/src/state.rs:509-514

noid_chain/src/state.rs:519-538

Every citation on this page points at a file that was opened during the audit. Nothing here is a guess.

Back to Projects