MONEU White Paper. July 2025 A Peer-to-Peer Electronic Cash System with Spending Secured by the physical entropy. Contents 1. Introduction 2. The quantum threat 3. The Noise-OTP shield 4. The physical source of randomness 5. Privacy and user safety 6. A transaction, step by step 7. The founding proof 8. Consensus and network defense 9. Monetary policy 10. Addresses and transaction format 11. Node architecture 12. A research idea: spent files as a randomness archive 13. Security model and limits 14. Parameter summary 15. Disclaimer 1. Introduction MONEU is a decentralized payment network built on SHA-256 proof of work. What sets it apart from other chains of this kind is resistance to attack by a quantum computer. Beyond that layer, MONEU uses methods proven in mature proof-of-work systems namely the UTXO model, Merkle trees and the choice of the heaviest chain. In a chain of this kind the right to spend is decided by the private-key signature alone. That is enough only as long as nobody can recover the private key from the public one. MONEU requires a second factor that a quantum computer cannot break. It's a one-time proof from a private file of physical randomness. The following chapters explain how this proof is made and how it works. 2. The quantum threat Digital payment networks rely on elliptic curves for their security. On standard computers the link between a public key and a private key is strictly a one-way street. A quantum computer running Shor's algorithm, however, can recover the private key directly from the public one. Once an attacker takes a public key from an old transaction, they can recover the private key and sign a new transfer of the coins. To the network this transaction looks completely legitimate, so no node will reject it. In this way an attacker can steal the funds and take over the identity of the wallet. This is why MONEU protects wallet spending with a shield built on the one-time-pad principle, which rests on noise. 3. The Noise-OTP shield At the heart of this protection is the Noise-OTP mechanism. It is a one-time proof built from noise relying strictly on the SHA-256 hash function and a Merkle tree. Shor's algorithm only works where there is a structure of factoring or discrete logarithms, and because hash functions have no such structure Shor cannot attack them. Grover's algorithm gives only a small speed-up which SHA-256 easily absorbs through its length. The shield simply rests on what a quantum computer leaves untouched. So as chapter four describes each wallet creates a noise file from physical randomness measured on the owner's machine. That file is then split into 32-byte pieces, and each piece acts as a single leaf. Every leaf gets a commitment and from all these commitments a Merkle tree is built. Its root marked as KPS serves as the public identifier for the wallet's noise. To authorize a transfer the wallet reveals one leaf and its Merkle path to the KPS together with the link between that leaf and the specific transaction. proof = SHA-256 of leaf + transaction_hash Because the proof is tied to the transaction hash, it cannot be used for another transfer, whether for a different amount or to a different recipient. A leaf can only be used once and after use it is spent for good. Chapter six describes how the network enforces this. So the core property of the shield is that spending requires the signature, the KPS and the noise file all at once. The first two are public or can become public while the noise file never leaves the owner's device and cannot be calculated from anything on the chain. An attacker with access to a quantum computer who recovers the private key still cannot create a valid proof for a transaction without an unused leaf from that file. 4. The physical source of randomness The point is that the noise file cannot be reproduced or predicted because the file is not made from a seed a password or a pseudo-random generator but from real physical events in the electronic hardware at the moment of creation. At the base of building this file is particle physics. The electron does not move along a fixed path but is a quantum object with a wave nature. Its position and momentum cannot be measured at the same time as the Heisenberg uncertainty principle states so the result of a single measurement is unpredictable by the nature of matter. In the silicon of a processor the flow of a vast number of electrons carries an unavoidable and truly random component known as thermal and shot noise. The generator runs a short operation many times and reads the CPU cycle counter before and after it. What matters is the difference and within it the least significant bits which change with every measurement because they reflect the physical noise of the silicon. One measurement gives little randomness so for safety each output byte is built from many thousands of measurements. To strengthen the variation the generator loads the processor and memory in the background and the load itself is not randomness but makes the physical noise weigh more heavily on the measured times. The second fast source is the timing of random memory accesses. Slower sources are the CPU temperature sensor and system counters and a small share from the kernel's own generator is added in case the direct sources are weak. The material gathered in this way passes through a hash function which spreads the randomness evenly across all output bits. The hash does not create randomness. It only spreads the randomness already gathered from physical events so that every byte of the file is indistinguishable from random. The randomness sources are a local matter of the wallet belonging to the MONEU node user and are not part of the network rules. The network sees only the KPS and checks proofs against it and the OTP noise file itself is never revealed on the network. Thanks to this new sources can be added later. For example noise from the radar data of a sand or snow storm, or noise from a camera sensor that comes from the quantum nature of photons landing on it without changing the network rules and without losing compatibility with older nodes. 5. Privacy and user safety Basing the secret on a file rather than on biometrics is dictated by respect for the user and by reducing the physical threat to them and by respect for the privacy and dignity of the MONEU user. MONEU does not require and will not require biometrics. No fingerprint. No palm-vein scan. No retina scan and no face recognition. Security based on the body makes the human body a target for people of ill intent. If biometric traits are tied to a person then any attacker could try to obtain them in a way that harms the wallet owner. In MONEU the access is protected by a file which can be copied for example onto several media in different safe places. Losing one copy does not remove access as long as another copy exists. The user's privacy in MONEU is imortant so deliberately does not take randomness from the keyboard or the microphone even though a microphone would be one of the better sources of entropy. Such sources would equire listening to the surroundings or recording keystrokes which means intruding on privacy. The physics of the CPU gives enough randomness that there is no need to reach for such sources. 6. A transaction, step by step Let us follow a simple example. Alice wants to send funds to Bob. Her wallet takes the first unused leaf from the noise file and builds a proof from it. The proof is made of three things. These are the leaf itself its Merkle path to Alice's KPS and the link between the leaf and this transaction hash. The wallet then signs the whole thing with Alice's private key under Ed25519 and broadcasts the transaction to the network. Each node checks five things. Whether the Ed25519 signature is valid. Whether Alice's public key matches her address. Whether the revealed leaf belongs to Alice's KPS along the Merkle path. Whether the proof is tied to this transaction's hash and whether the leaf has not been used before. Only when all five hold does then transfer enter a block and Alice's leaf is marked as spent. Bob receives the funds on a transaction output which he will later spend with his own leaf from his own noise file. A leaf's one-time use is checked at five levels so that there is no moment when the same leaf can pass twice. In a single transaction. In a single block. In the transaction queue. In the set of spent leaves for the whole chain and finally when the state is written. The set of spent leaves is tied to the active chain so even if an ordinary network reorganization detaches a block the leaves it spent return to the pool and its transactions return to the queue and confirm on the chain that won. In this way the set of spent leaves always matches the active chain. One important point follows for Alice and Bob. The noise file is as important as the private key so its copies must be kept just as carefully. 7. The founding proof The genesis block holds a proof that anyone can check. The reward from the genesis block is 77 coins and goes to an address whose private key is published openly in that block's message. In MONEU these funds cannot be moved even though the private key is visible to everyone. Anyone can import this private key and confirm that holding the key alone does not allow the coins to be moved. 8. Consensus and network defense Which chain is the right one is decided by the greatest total work never by height alone and the data is governed by the UTXO model. Anyone who runs a node can download the full history from the founding block and reach the same state by checking everything themselves. Two further mechanisms protect the history. The first is a limit on reorganization depth of 1000 blocks. The second is checkpoints that fix chosen blocks and strengthen the protection of a young network history. The mining difficulty adjusts once every 2016 blocks which at the target pace is roughly once every two weeks. The network measures the real time of the recent blocks and corrects the difficulty in order to return to a pace of one block every 10 minutes. MONEU does not use algorithms that change difficulty after every block because on small networks they cause sharp swings. A rare adjustment over a large window keeps the difficulty steady between corrections. It is important to accept that no proof-of-work network is inherently safe from an attack with large computing power and young networks can be a target for people of ill intent who use such power to try to disrupt or freeze them. MONEU does not pretend to be fully immune to this. Full resistance is reached gradually and grows with decentralization with the network total power and with adoption. The more independent miners and nodes there are the more expensive and harder the network is to attack. 9. Monetary policy The MONEU supply is fixed at 30,000,000 coins. This is the sum of all rewards the network will ever pay. It is made up of the initial reward of 77 coins which falls after each halving and a halving occurs every 194,804 blocks. The supply consists of 29,999,812.41 coins from the declining era plus 77 coins of the founding reward together 29,999,889.41, which leaves 110.59 coins of headroom to the limit. One coin divides into 100,000,000 smallest units. So the block reward starts at 77 coins and halves every 194,804 blocks that is roughly every 3.70 years. The first era produces close to half of the whole supply about 14,999,908 coins. The declining era is 23 epochs and roughly 85 years and the interval 194,804 was chosen so that the sum of the whole era together with the founding reward fits under the limit of 30,000,000. From the 23rd epoch the reward stops halving and stays at a fixed token level of 1000 smallest units per block. That is 0.00001 coin. This gives about 0.53 coin a year for the whole network. The change is smooth because the last epoch of the declining era pays 1835 units so the 1000 threshold makes no jump and emission fades gradually and never reaches zero. This final emission is an extra technical and monetary safeguard that should not be seen as an incentive for miners. It protects the network from a zero-reward state and the block reward never drops to zero because these 1000 units are created in every block without end. Once the base supply is exhausted, the main pay for miners is transaction fees and the tail reward is only a small addition to them. This stream is so small that only after more than 200 years does the total emission match 30,000,000 coins nominally while the network keeps working without any change. The whole transaction fee goes to the miner who includes the transaction in a block which keeps the incentive to secure the network strong once the base supply is spent. The fee follows the size of the transaction in bytes so a larger transfer pays proportionally more and a minimum per-byte rate together with a dust threshold keep the network free of clutter from tiny transactions. A sender may attach a higher fee to have their transaction confirmed sooner since miners order pending transactions by the fee paid per byte. 10. Addresses and transaction format MONEU uses the Ed25519 curve for signatures. An address in MONEU is not a plain hash of the public key but is tied to the shield. It is formed as a Base58 checksum over a version byte, the key hash and the KPS. Address_hash = SHA-256 of public_key + KPS Address = Base58Check of version_byte + address_hash A payment address has value 33, a script address 110, and an exported private key 183. Payment addresses therefore begin with the digit 2 and are 51 characters long. A sample MONEU payment address looks like this. 27sgAtodPAppDmVQsJy5vPKWmNitPq8gazWuqxs6rUrBQgip7N1 A Bech32 format using the prefix "meu" is also available. The KPS is part of the address hash so nobody can create a valid address without both the key and the noise file. This ties a user's identity directly to a specific randomness file right at the address level. Transactions use the UTXO model. Every input points to the output being spent and includes the public key the signature, the KPS, and the noise proof. The noise proof is made of the revealed leaf its position and a link to the transaction hash. Each output simply sets an amount and a destination address hash. Transaction can also carry up to 300 bytes of extra data in an OP_RETURN field which can be used to store something like a document hash for a digital notary record. 11. Node architecture MONEU is a network of equal nodes with no central server. Each full node keeps the whole history and checks every block and every transaction itself without relying on anyone. The network layer keeps connections and passes on blocks and transactions within limits that guard against overload. The transaction queue checks and holds transfers waiting for confirmation with protection against double spending and reuse of a leaf. The consensus engine checks the proof of work adjusts difficulty and picks the heaviest chain. The validation layer checks the full rules of a block and a transaction. The state store keeps the UTXO set and the set of spent leaves in line with the active chain. The wallet manages keys as well as the noise file and the building of transactions. A start point has no power over the rules and serves only for the first contact. Node offers an RPC interface and a command-line tool for managing the wallet mining and querying the network. 12. A research idea: spent files as a randomness archive Each noise file is a large collection of truly physical randomness made of hundreds of thousands of pieces from real events in hardware. When the owner has used every leaf drom the file then the file thet loses its value for the wallet because no unused leaf remains in it to authorize a transfer. It do not lose its value as physical material which is what a spent OTP noise file is. If the community wishes fully spent files could be shared on a voluntary basis as a collection of good physical randomness useful for research into random generators including the testing of entropy quality and work on encryption. Such a growing public archive of randomness from real-world events held on a dedicated server could be very useful for civilian cryptography including the building of systems that detect privacy-violating software. Sharing such spent files does not endanger any funds because a spent file gives no power over any address. The noise file is tied to a KPS and through the KPS to the owner addresses so sharing it may reveal links between those addresses. For this reason sharing must be fully voluntary and informed and the choice belongs only to the owner of the file. MONEU does not require such files to be made public. 13. Security model and limits The mechanisms described above give resistance to quantum takeover of funds. One-time use of leaves, no double spending thanks to the UTXO model a consistent state across reorganization and a harder path for an attack with large computing power. Each of these is described in its own chapter. It should be remembered that MONEU does not protect against the loss of one's own noise file or key because the safety of these files rests with the wallet owner who is a user of a MONEU node. It should also must be remembered that no small proof-of-work network is fully safe from an attack with computing power so the aim is not to make an attack impossible but to make its cost high and unprofitable until resistance grows with decentralization and adoption. 14. Parameter summary The network is called MONEU. The proof of work is SHA-256 the signature curve is Ed25519 and the shield is one-time leaves from a file of physical randomness. The address hash is formed as SHA-256 of the public key and the KPS. A payment address has the Base58Check format with version byte 33 begins with the digit 2 and is 51 characters long. A script address uses version 110. A private key uses 183. The Bech32 format uses the prefix meu. The maximum supply is 30,000,000 coins and one coin divides into 100,000,000 units. The block time is 600 seconds. The initial reward is 77 coins per block. Halving occurs every 194,804 blocks that is about 3.70 years. The declining era is 23 epochs and about 85 years after which the final emission is 0.00001 coin per block. The difficulty adjusts every 2016 blocks that is about 14 days with an asymmetric limit on the adjustment. The maximum reorganization depth is 1000 blocks and the maximum block size is 6 mebibytes. The coinbase maturity is 50 blocks. The maximum OP_RETURN size is 300 bytes. The P2P network port is 8327 and the RPC port is 8328. 15. Disclaimer This document describes the technical design of the MONEU network and is not an offer nor investment or financial advice. MONEU is Experimental open-source software provided without warranty and taking part in the network is at your own risk. Every user has a duty to look after the safety of their noise file just as carefully as their private keys. The owner is responsible for keeping private keys and noise files safe and their loss means a permanent loss of access to funds. Out of concern for user safety I recommend encrypting noise files and keeping their copies on safe independent media. I am also not responsible if a user's operating system or machine is compromised by malicious actors leading to the theft of the noise file or private keys. Acknowledgements I thank Adam Back for Hashcash and the idea of proof of work based on a hash function. I also thank Satoshi Nakamoto for building a decentralized consensus on that foundation. MONEU chooses not to use the post-quantum signature schemes that NIST and the NSA recommend. I believe that solutions built on Merkle-tree one-time proofs and physical entropy are far simpler and leaner. natusor natusor@tutamail.com