Claim a rung
If you know a rung's discrete logarithm k, you can claim its bounty. The claim proves you know k without revealing it, and it pays only the recipient address the proof names, so nobody who sees your transaction can copy it or redirect the bounty. A claim is legal, has no victim, can be pseudonymous, and can name any address as recipient, a charity's included.
What the claim proves
Each rung publishes two points, G and Q, with Q = k·G for a k nobody knew when they were generated. A claim is a Schnorr proof:
- Pick a random w and compute R = w·G.
- Compute the challenge e = SHA-256("canary.claim.v1" ‖ program id ‖ rung id ‖ recipient ‖ job nonce ‖ R ‖ G ‖ Q ‖ transcript hash), reduced mod n.
- Compute s = w + e·k (mod n).
The program checks s·G = R + e·Q. Because e commits to the recipient, changing the recipient changes e, and a valid s for the new e can only come from someone who knows k.
The steps on chain
| Step | What it does |
|---|---|
begin_claim | Records the proof and the time. That time becomes the rung's event_ts. |
step_claim | Verifies part of the scalar multiplication. Anyone can send it; the claim tool sends them all. |
finalize_claim | Completes the check, sets RungState to Solved and pays the bounty to the recipient. |
Verification is staged across several transactions because the Q-rungs and C-160 use field arithmetic that Solana has no syscall for. The terminal rungs verify in a single transaction with Solana's own curve syscalls.
| Rung | Verification | Transactions |
|---|---|---|
| Q-160 | Staged Schnorr, 161-bit scalars, 16 bits per step | 13 |
| Q-192 | Staged Schnorr, 192-bit scalars | 14 |
| Q-224 | Staged Schnorr, 225-bit scalars | 17 |
| T-256k | Schnorr, scalar multiplications through sol_secp256k1_recover | 1 |
| T-255e | Schnorr through sol_curve_multiscalar_mul | 1 |
A claim must finalize within 300 slots of begin_claim. The claim tool sends the steps back to back, well inside that window.
Claim in the app
On Claims, choose the rung and enter k as hex. The app builds the proof in your browser and k never leaves it. The bounty goes to the connected wallet, which the proof names as its recipient. Approve the transactions in your wallet and watch the rung change to Solved. To pay another address, use the command line below with --recipient.
Claim from the command line
The claim tool in the Canary repository (backend/canary-claim) does the same from a terminal and pays fees from a keypair file. It reads k from a file or from standard input, never from an argument, so it never lands in your shell history:
npm run claim -- --rpc <RPC URL> --program-id <canary_rungs id> \
--payer-keypair <keypair.json> --recipient <address> \
--rung <rung number> --secret-file <file holding k in hex>
| Rung | Number |
|---|---|
| Q-160 | 0 |
| Q-192 | 1 |
| Q-224 | 2 |
| C-160 | 3 |
| T-256k | 4 |
| T-255e | 5 |
It prints the proof hash, each transaction's signature and the final RungState.
What happens next
- The bounty pays the recipient in the same instruction that sets Solved.
- Markets on the rung resolve YES if the claim began on or before their expiry.
- Q-Vaults with the rung as their trigger stop accepting Ed25519.
- The status feed and every integrator reading the account see Solved at once.
The bounty is the same for Q-160 and C-160, so a classical solver gains nothing by claiming C-160 to look quantum.