Tri-Pillar Consensus

Abstract

1. Introduction

The dominant consensus paradigm in modern blockchain systems — Proof of Stake (PoS) and its variants — shares a common structural weakness: validator influence scales proportionally with token holdings. This creates plutocratic feedback loops where wealthy validators accumulate disproportionate block rewards.

This paper presents three protocols that together solve this problem:

1.1 Limitations of Existing Systems

2. Protocol 1: Proof of Hidden History (PoHH)

2.1 BurnEvent Structure

BurnEvent {
    burner:    address,   // wallet that triggered the burn
    amount:    uint256,   // tokens burned (18 decimals)
    timestamp: uint256,   // block timestamp
    slotId:    uint256    // slot identifier
}

2.2 BHH Entropy Computation

targetSlot = previousSlot if |burnPool[previousSlot]| >= 3
           else lastValidSlotId

selectedIndex = randomWord % |burnPool[targetSlot]|
selected      = burnPool[targetSlot][selectedIndex]

BHH_entropy(N) = keccak256(
    selected.burner,
    selected.amount,
    selected.timestamp,
    selected.slotId
)

2.3 PoHH Seal

PoHH_seal(N) = keccak256(PoH_hash(N), BHH_entropy(N), slot_id(N))
drawRand     = keccak256(VRF_randomWord, PoHH_seal)
member[0]    = weightedSelect(candidates, effectiveTickets, drawRand)

# effectiveTickets is the COMMITTED weight vector: a node in cooldown or
# excluded by conduct carries zero, so it is skipped arithmetically rather
# than by a per-candidate lookup. The vector is fixed at request time,
# before the VRF word exists.
#
# member[0] is the primary draw, NOT a leader. All three members carry
# identical duty and identical reward; the address is published singly
# only because an external consumer must be able to name one party.

2.4 Security Scaling

3. Protocol 2: Proof of Commitment & Streak (PoCS)

3.1 The 21-Tier Commitment Ladder

3.2 Commitment Accrual (v2)

Earlier versions used a consecutive-day streak that reset on any gap. It was replaced because it measured the wrong thing: it counted the days a participant sent a transaction, not the days their capital was actually committed — and it punished a flat battery exactly as hard as abandonment.

WINDOW = 242 days                 (constant, not governable)

Time accrues continuously while the stake floor is met:
  accruedStakeSecs += elapsed     (no daily action required)

Days sit inside a rolling 242-day window — twice the 121
the top rank needs, so up to half of it may be missed.

A missed day costs A DAY, NOT A STREAK. Nothing resets.

rank = min(rankByDays, rankByStake)
       ↑ both gates must be met; the lower one binds.

3.3 Early Unstake Mechanism (v2.0)

unstakeEarly(stakeIndex):
    daysHeld     = (block.timestamp - startTime) / 86400
    earlyAprBps  = originalAprBps / 2
    reward       = principal × (earlyAprBps / 10000) × (daysHeld / 365)
    return principal + reward

Example — Tier 18 (100% APR, 180-day lock):
  Unstake at day 90: reward = 1,000 × 50% × (90/365) = 123.3 TRITO
  Normal at day 180: reward = 1,000 × 100% × (180/365) = 493.2 TRITO

3.4 Four-State Economy Integration

Normal state:   Full APR (5%-130% per tier)
Warning state:  APR reduced by rebalancer
SOS state:      5% flat all tiers
HardCap state:  0% (no minting — network under stress)

4. Protocol 3: Community Engagement Rank (CeR)

4.1 Staking Pillar Ranks (max 1,024 tickets)

4.1b Trading Pillar Ranks (max 1,024 tickets)

No stake requirement — a trader who never locks capital can still climb. A burn qualifies when it exceeds a minimum tied to the rank being claimed and goes to an address other than the sender; only the amount destroyed counts, since a transfer between two wallets one controls costs nothing but the burn.

4.2 Behavior Pillar Adjustments

4.3 Attack Resistance

TIME CANNOT BE PURCHASED

Attacker buys 10,000,000 TRITO, stakes today:
  0 days accrued → F-New → 1 staking ticket

The capital is present; the time is not. Rank requires
both gates, and the lower one binds.


SPLITTING CANNOT DILUTE

358,400 TRITO in one wallet, 121 days:
  SS-Immortal → 1,024 tickets

358,400 TRITO split across 1,024 wallets, 121 days:
  1,024 x F-New → 1,024 tickets

Identical. Tickets are a fixed division of the resource
committed, so weight is linear in it — and any linear
weighting is indifferent to how it is divided.

A sub-linear curve would REWARD splitting; that is the
failure this replaces.


WHAT IS NOT CLAIMED

Capital now matters. A participant holding 1,000 TRITO
cannot reach SS however long they wait — the stake gate
caps them at E-Novice. The protection is that influence
cannot be acquired QUICKLY, and cannot be MULTIPLIED by
fragmenting a holding. It is not a claim that small
holders outweigh large ones.

4.4 Merit Credentials — ARETE and MUNERA

Two non-transferable credentials sit alongside the ticket system. Neither can be bought, sold or moved: there is no transfer function, no approval, and no market. They exist to make certain powers reachable only by participation, in a protocol where capital already buys the entry ticket.

Each is earned by one activity and spent on the other, and that cross-link is the part that makes the system stable rather than a flourish. If sealing earned the credential that improved sealing, the most-selected operators would compound into permanent dominance and the cooldown between selections would stop doing its job. Crossing the two means winning selections never buys more selections — it buys better staking terms, which is a different axis entirely.

Base staking APR was reduced to one third when ARETE was introduced, and ARETE restores it. This was not a yield cut dressed up as a feature: staking previously minted far more TRITO than node rewards did, and node rewards are burn-backed while staking was minted against nothing. Yield above the base is now earned through consensus work rather than bought with capital, and total issuance roughly halves.

5. Tri-Pillar Integration

Block Sealing Flow

Step 1: ACTIVITY GATE — a slot may open only once the closing one
        cleared BOTH bars: burn VOLUME and a distinct burn EVENT count.
        Neither implies the other: one whale transfer clears any volume
        bar while producing exactly one event. Slots therefore track real
        activity rather than a clock.

Step 2: requestSlot()
        → PoH hash: keccak256(blockhash, currentSlot)
        → The CANDIDATE SET is resolved and committed HERE — eligible
          nodes, their cooldown-adjusted weights, and the weights root.
          Doing this before randomness exists means no party who learns
          the VRF word can influence who was a candidate for it.
        → VRF request fired to Chainlink

Step 3: Chainlink VRF returns randomWord
        → fulfillRandomWords() triggered

Step 4: Inside fulfillRandomWords():
        → BHH: the VRF word selects one burn event from the valid slot
        → PoHH seal: keccak256(PoH_hash, BHH_entropy, slotId)
        → THREE EQUAL SEALERS drawn from the committed weight vector.
          There is no leader. The address published externally carries
          the primary draw only because an outside consumer must be able
          to name one party; it holds no extra duty and no extra reward.
        → NOTHING IS MINTED HERE.

Step 5: Seal window
        → Each member independently derives the slot's result and submits
          it with submitAttestation(). A member that merely shows up earns
          nothing — the work is agreeing.

Step 6: finalizeSlot()
        → Two of three must have submitted the SAME value for the slot to
          seal. Matching members are paid a FLAT, IDENTICAL share to their
          owner wallet; a member that disagreed or never attested is not.
        → Issuance is burn-backed: the reward is computed from TRITO
          actually destroyed in the previous slot, so a quiet market mints
          nothing at all.

Step 7: Next slot
        → The seal and the committee become entropy leaves for a FUTURE
          slot's BHH selection. Every component is fixed at fulfilment, so
          the leaves cannot be ground by choosing to seal or not.

5.1 Presence — absence is not misconduct

Comparison to Major Consensus Systems

6. Novelty Claims

To the authors' knowledge, the following claims represent genuine novel contributions to blockchain consensus research as of June 12, 2026:

7. Implementation

7.1 Smart Contract Architecture

7.2 Deployed Addresses (Arbitrum Sepolia, CeR v2)

TRITOToken:              0xE5625CE0308054EEcBCC9444beA7cbbF9E009ee9
TRITOStaking:            0x1635FBC162Eae19b8EAC74fD828411e6d4a3Abb4
CEROracleV2:             0x207178a1679267A32C33d81baC4575933c9186e0
TRITOSequencer:          0x9De332379dF06aF8DF6f71376dcfDfbE62Aae57e
TritoIssuancePolicy:     0x88C76fA268Fcb4739c79ACE356B2302a3F552871
TritoSequencerLens:      0xf59F07675C835655f6d6D9Fc81ac77AF6712b55a
TRITOBurnForwarder:      0x206E548e9a3193377ca15bb1Ddea575De00ca64d
TritoSequencerSelector:  0xfCC878d7Ce207fD5444F37EB5592a5A10690fc33
TRITONodeConductV2:      0x800DA86dbEd73507B9F165f47C47f591b4051C28
ARETECredential:         0x8E0Bc6aB59A83F476495b89FC49580735F2bc2D6
MUNERACredential:        0xbe7E2907938Da3A373AeD2FCaCe055003C191e30
TritoNotary:             0xbAb74285E0D795F1583b9F10b25d9d7C1A577685
TritoNotaryLens:         0xc5F4792c3edE72367f869148925dF72F04C778Ec
PresenceAnchor (ArbSys): 0x1E53732A2196923396FA6f863B6915753efd6493
TRITORebalancer:         0x72c5C48E45D126184F109Fde09707806F505faf6
TRITOReleaseCalendar:    0x9046F40751C0603a5222854f156D37EE3b321b0e
RegistrationGift:        0x3F5D7A12238d29F136a30405D6EfC2eB5e14D2dB
TRITOVestingVault:       0x88fc55128BbBB86F69D3ae103EBf60a127c7b7e9
TRITOAirdropDistributor: 0x2469Aa07d87a19F927B50433eb4e96fDb439F3B3

Multi-tenancy (2026-08-30):
TritoTenantRegistry:     0xc0915D2271A14897398C33657a8080D69713Eac4
TritoElection:           0xcfd26c35feE886078c6AD4a61D997ea56a48F037
TritoTenantPerformance:  0x77f5c09F678E788D3267f4918986EF652B218f55
TritoRewardPool:         0xDA58f6E88a79edD8404Bb342b1e54D6026c2Bab2
TritoFloorPayer:         0xd13aFeeA97686f99b6A968EDD7aB53F2737a2068

TRITOToken is never redeployed — it holds every balance.
Everything else above was replaced at the CeR v2 rebuild
because each held an immutable reference to the oracle.

Sequencer + Selector replaced 2026-08-08: the VRF callback exceeded
Chainlink's 2,500,000 gas ceiling once the network had enough nodes
to seal continuously, stranding three slots. The candidate set is
now resolved when a slot is requested rather than inside the
callback — 2,642,585 gas before, 832,537 after.

Conduct replaced 2026-08-17 to add presence heartbeats, so a node
that is offline is simply not selected rather than accruing misses
toward dormancy.

Sequencer replaced again 2026-08-29 for issuance v4: rewards now
scale with burn volume instead of clamping to a flat 210. The
contract had reached EIP-170's 24,576-byte limit, so the economic
parameters moved to TritoIssuancePolicy and the read-only audit
surface to TritoSequencerLens — both replaceable without touching
consensus.

7.3 Tokenomics

7.4 Notary — corroboration as a service

Summarised here as a deployed component; see §8 for how it sits alongside the other services offered to external chains.

Economics

8. Services for External Chains

Electing a committee produces something reusable: a set of independently-operated machines, chosen by verifiable randomness, weighted by reputation earned over months, and required to agree before anything is recorded. That object is useful to parties who have no interest in TRITO's own consensus. What follows is what TRITO offers them, what it charges, and — as importantly — what each service does not claim.

8.1 Notary — corroboration (live, paid)

8.2 Committee election (deployed on testnet, paid)

8.3 Entropy beacon (live, free)

9. Conclusion

This paper has introduced three novel blockchain consensus protocols — PoHH, PoCS, and CeR — that together form the TRITO Tri-Pillar Consensus framework. Each protocol addresses a distinct limitation of existing consensus mechanisms:

The combination creates, to the authors' knowledge, the first consensus system where validator influence cannot be purchased with wealth alone but must be earned through sustained behavioral commitment to the network.

10. Intellectual Property Declaration