VERIFY · IN BUILD

Snapshots

A dataset you can sum yourself, its checksum, the Merkle root over it, and the command that reproduces both. Do not take the proof page on trust; recompute it.

◐ Fixture data · algorithm real, entries are not

The tree below is genuine and every proof it produces verifies. The entries are fixtures, and no root has been anchored to any chain. A snapshot of the live ledger cannot be published until balances are integers behind one guarded writer — a dataset drawn from a float ledger with 124 writers would not reproduce twice, and a reader who fails to reproduce a published root has learned something false about our competence rather than something true about our data. Verify the mechanism here; do not treat it as evidence about the ledger.

The current commitment

Snapshot date2026-08-14
Entries committed5
Excluded1 · read failed, excluded rather than zero-filled
Outstanding liability18 887.50 FG
1888750 minor units · FG counted · no commodity units exist yet to exclude
Dataset sha2560x44393ce7c539845287eff4cbac19ba261ea2477f2d2570ac6e4a28985283ab9b
Merkle root0x710643fd552b7a1bd4c8bacdd76d7f9556806ee18ed4d2763478b93e733e0dba

What is inside the liability

Σ of every entry amount in the published snapshot, over obligation-class assets only — the ledger classes REWARD_CURRENCY and PARTNER_CREDIT. Commodity units are excluded and named. Signed integer minor units throughout, summed as BigInt — a total in the hundreds of millions of minor units exceeds what a double holds exactly. Reproduce it from the JSONL on /snapshots/.

AssetLedger classIn the liabilityBasis
Flashy Gold FGReward currencyCountedRedeemed against a stated obligation for stated goods, so every outstanding unit is something the group owes. See /redemption/.
Wheat WHEATCommodity unitExcludedProduced and consumed inside the economy. Nothing can be presented to the group in exchange for it, so it is not a debt.
Stone STONECommodity unitExcludedA building input, destroyed on use. Inventory inside the economy, never a claim.
Wood WOODCommodity unitExcludedA building input, destroyed on use. Inventory inside the economy, never a claim.
Iron IRONCommodity unitExcludedSpent to initiate and to defend raids, destroyed on use. Inventory inside the economy, never a claim.

The class names are the ledger’s own — REWARD_CURRENCY, COMMODITY_UNIT, PARTNER_CREDIT — so the perimeter published here and the field stored on the asset are one fact rather than two. Commodities do not exist yet. The rule is written now so that adding the first one is a row in the asset registry rather than an argument about what a published total meant last quarter.

∅ Unavailable · outstanding liability, book-wide

The published snapshot is a sample, and the live book stores amounts as floats behind 124 writers. A book-wide total drawn from it would not reproduce between two reads. Blocked on CYG-LED-1 — integer minor units — not on effort.

How the root is built

Specified rather than described, so it can be reimplemented in a language we did not choose. A root only we can compute is a number we assert, not a number you check.

canonical(entry) = id | asset | type | source | amount_minor | recorded_at
                   joined with U+007C, no padding, no whitespace

leaf(entry)      = SHA256( 0x00 || utf8(canonical(entry)) )
node(left,right) = SHA256( 0x01 || left || right )

leaves sorted by id, ascending, byte-wise
odd nodes are promoted to the next level, never duplicated

tenant(id,root)  = SHA256( 0x02 || utf8(id) || 0x1f || root )

tenants sorted by id, ascending, byte-wise
one day root over every tenant subtree — one transaction per chain per day

Why the 0x00 / 0x01 prefixes

Domain separation. Without it, an internal node digest can be presented as though it were a leaf, and an inclusion proof forged for an entry that was never in the tree.

Why odd nodes are promoted

Duplicating the last node to pad a level lets two different entry sets produce the same root — the flaw behind CVE-2012-2459. Promotion carries the node up unchanged.

Reproduce it

# the proof for one entry, self-contained
curl -s https://flashynetwork.com/api/v1/public/ledger/proof/gl_01K2F7QW3M/ | jq

# rebuild the root from the dataset
npx tsx scripts/anchor.ts

The self-check in that script proves every entry against the root before it will print one, so a broken tree fails here rather than in front of a reader who could not reproduce a published number.

Where roots get published

TargetNetworkWhy it earns a rowState
TON TestnettestnetThe strategic home, on testnet first. Proves the pipeline against the chain our holders are closest to, at no cost and with no claim that it is production.IN BUILD
Base SepoliatestnetThe credibility anchor, on testnet first. EVM, so the deepest auditor and tooling pool. Proving the pipeline here costs nothing and means the first mainnet root is not the first root we have ever produced.IN BUILD
Avalanche FujitestnetAvalanche on testnet first, for the same reason as Base Sepolia: the first mainnet root must not be the first root the pipeline has ever produced. EVM C-Chain, so it reuses the calldata format and the on-chain verify() unchanged.IN BUILD
TONmainnetWhere the people who hold Flashy Gold already are. Telegram-native, and the chain that makes the settlement record legible inside the product rather than only to auditors on a desktop.NORTH STAR
BasemainnetThe one an integrator checks. Median fee near two cents, so a daily root is on the order of seven dollars a year regardless of how many entries the day contained.NORTH STAR
Avalanche C-ChainmainnetSub-second deterministic finality and a cent-scale fee, so a daily root is confirmed in one block a reader can watch rather than a probabilistic wait. Same 32 bytes and same verify() as every other EVM target — the cost of adding it was one config row.NORTH STAR

No contract is deployed on any of them. A root is 32 bytes in a transaction — it needs no contract, and deploying one named after Flashy Gold would create exactly the artifact /no-contract/ exists to say does not exist.