What Canary is
Canary is a ladder of funded discrete-log bounties on Solana. Each rung is a public point whose discrete logarithm nobody knows. When someone solves one and claims it, the rung's Solana account changes from Open to Solved, and every market and Q-Vault that reads that account acts on it, with no oracle and no committee.
The six rungs
The rungs climb in the cost of breaking them with a quantum computer, measured in logical qubits. Each one sits past the public classical record of about 265–268 operations.
| Rung | Family | Field / subgroup bits | Classical cost (Pollard rho) | Logical qubits (Roetteler et al. 2017) |
|---|---|---|---|---|
| Q-160 | Quantum rung | 160 / 161 | ~279 | 1,466 |
| Q-192 | Quantum rung | 192 / 192 | ~295 | 1,754 |
| Q-224 | Quantum rung | 224 / 225 | ~2111 | 2,042 |
| C-160 | Classical control | 256 / ~160 | ~279 | ~2,330 |
| T-256k | Terminal rung, secp256k1 | 256 / 256 | ~2127 | 2,330 |
| T-255e | Terminal rung, Ed25519 | 255 / 253 | ~2126 | ~2,330 |
- Quantum rungs (Q-160, Q-192, Q-224) are the SEC 2 curves secp160k1, secp192k1 and secp224k1: prime-order curves of the form y² = x³ + b, the same family as secp256k1, over 160-, 192- and 224-bit fields. A quantum attack on them needs fewer qubits than one on secp256k1.
- The classical control (C-160) costs the same as Q-160 classically, but a quantum attacker needs 256-bit field arithmetic and therefore about as many qubits as a full secp256k1 break. If Q-160 falls while C-160 stands, the cause is far more likely quantum than classical.
- Terminal rungs (T-256k, T-255e) are nothing-up-my-sleeve points on secp256k1 and on Ed25519, Solana's own curve.
Every rung's two points, G and Q, come from a published seed by hash-to-curve, so nobody knows their discrete logarithm, including the people who generated them. C-160 joins the ladder when its curve's point count is certified.
RungState
Each rung has one account, RungState, at the program address derived from the seeds ["rung", id]. It reads Open until a claim finalizes, and then Solved for good, with the time the claim began (event_ts), the slot, the recipient and a hash of the proof. Programs read it directly; everyone else can read the status feed.
What reads a rung
| Reader | What it does when the rung reads Solved |
|---|---|
| Bounty vault | Pays the bounty to the solver's recipient address in the same instruction |
| Rung-event market | Resolves YES if the claim began before the market's expiry; NO holders win if the expiry passes with the rung Open |
| Quantum-signal market (opens with C-160) | Resolves YES if Q-160 falls while C-160 is still Open |
| Q-Vault | Rejects every Ed25519 spend from then on; only the vault's Falcon-512 key can move funds |
| Your program | Whatever it is written to do: freeze, migrate, pay out |
Who uses Canary
| You are | You want | Start here |
|---|---|---|
| A sponsor (exchange, custodian, treasury, foundation) | Visible, verifiable quantum-risk monitoring | Fund a bounty |
| A hedger | A payout if a rung falls | Trade rung-event markets: buy YES |
| An underwriter | Premium from those who hedge | Trade rung-event markets: hold NO |
| A holder of SOL or tokens | Funds that keep a way out after an Ed25519 break | Keep funds in a Q-Vault |
| A solver (a quantum lab, a cryptanalyst) | The bounty, with no victim | Claim a rung |
| An integrator (multisig, bridge, custodian) | An objective trigger | Read RungState |
The three programs
| Program | Holds | Upgrade policy |
|---|---|---|
canary_rungs | The rungs, their bounty vaults, claim verification | Immutable after audit: its upgrade authority is revoked |
canary_markets | Rung-event markets, resolution, fees | A 3-of-5 multisig with a 7-day timelock in v0, frozen in v1 |
canary_vault | Q-Vaults | A 3-of-5 multisig with a 7-day timelock in v0, later a Falcon-gated Squads multisig |
The CANARY token
CANARY has a fixed supply of 1,000,000,000, all sold in one public launch. The protocol's 70 % of every settlement fee buys CANARY on the market and burns it. It is never collateral, a resolution input or a vote on rungs and vaults. See The CANARY token.
The program ids of this deployment are listed at https://API_ORIGIN/v1/programs.
The litepaper explains the design in ten minutes; the whitepaper covers every mechanism, account and formula.