Certificate of calibration
The instrument
No.SV-01
Instrument
SIEVE hook, a Uniswap v4 hook on Ethereum mainnet holding five lattice instances in Rq = Zq[x]/(xn + 1), q = 12289, n = 64, 128, 256, 512, 1024.
Reference standard
Falcon's modulus q = 12289. Lattice Lh = {(f, g) : f h = g mod (q, xn + 1)}, dimension 2n, determinant qn. h is uniform over the units of Rq: random NTRU-shaped lattices in Falcon's ring, with no planted key.
Measured value
The shortest vector anyone has chosen to publish on each rung, read as its norm, its root Hermite factor delta = (norm / sqrt(q))1/(2n) and its implied BKZ blocksize. Every rung starts at the trivial bar, normSq q2 = 151,019,521.
Uncertainty
The blocksize reading comes from the GSA model, good to about 10x in cost. Exact SVP at dimensions 32 and 48 sat 10% and 7% above the Gaussian heuristic M; a record far below 0.9 GH means the instance is not uniform, and the site flags it.
Traceability
Instances come from a drand quicknet round pinned at open() about 60 s ahead and verified on chain by arm() (BLS on EIP-2537). rootSeed = keccak256("SIEVE/root/v1", chainid, hook, drandRound, sig). Residual trust: a threshold of League of Entropy nodes.
Why only powers of two. x3m + 1 factors as (xm + 1)(x2m - xm + 1), so a short vector of the m-instance lifts to the 3m-instance at exactly sqrt(3) times the norm (9 of 9 lifts verified, ratio 1.7321 M). That rules out 96, 192, 384 and 768.
Roles. n = 64 is an unpaid practice rung. n = 128 and 256 are paid. n = 512 and 1024 are Falcon's own sizes and act as alarms with a capped escrow; they are expected to read "no record" indefinitely.
The check. SIEVE's check is keccak and integer arithmetic, with no trusted setup, and every record can be re-checked by schoolbook multiplication.
Issued 2026-11-01Spec sections 1 to 3
SIEVE
q = 12289
SV-01
Certificate of calibration
Fee paths
No.SV-02
Instrument
The hook's swap callbacks: beforeSwap, afterSwap and their return deltas. Permission flags 0x20CC (BEFORE_INITIALIZE, BEFORE_SWAP, AFTER_SWAP, BEFORE_SWAP_RETURNS_DELTA, AFTER_SWAP_RETURNS_DELTA).
Reference standard
2% of the ETH side of every swap, in ETH. 1% to the fixed owner address, 1% to the reward pot. ETH is currency0. No launch tax, no anti-snipe tax.
Measured value
The fee charged on each of the four v4 swap shapes, below.
Uncertainty
None on the split. Aggregators that rely on partial fills or exact-output sells fail on this pool.
Traceability
Fees are minted to the hook as ERC-6909 claims inside the PoolManager. No ETH transfer and no external call on the swap path. claim() and sweepOwner() are separate transactions: pull only.
| Swap | ETH is | Where the fee is taken |
|---|
| Exact-input buy | specified | beforeSwap, on the specified currency; afterSwap reverts if the swap filled less ETH than the fee was charged on |
| Exact-output buy | unspecified | afterSwap, return delta on the unspecified currency |
| Exact-input sell | unspecified | afterSwap, return delta |
| Exact-output sell | specified | reverts (ExactOutputSellUnsupported) |
Opening. 1 ETH FDV, a single-sided token band below a pinned price, LP NFT minted to the owner. beforeInitialize reverts unless called from inside the hook's own open(), so nobody can initialize the pool first. tickSpacing 200. The owner's position carries a 1% static LP fee (ECON.md run 2). No reward reads the pool price, so the owner trading against its own liquidity cannot move the dial or farm the pot.
Pot split. Applied lazily at the next reveal, claim or poke(): 50% to rung 128, 45% to rung 256, 5% to the alarm escrow. Rung 64 receives nothing.
Issued 2026-11-01Spec section 5.1
SIEVE
2% ETH side
SV-02
Certificate of calibration
The record rule
No.SV-03
Instrument
commit (inside a buy), reveal(n, recipient, salt, payload), finalize(n), challenge(n, entryId, f, g).
Reference standard
A new entry needs 0 < normSq ≤ floor(0.98 x tail), where tail is the last pending entry or, with an empty queue, the finalized record. Initial record q2 = 151,019,521. The 2% step is about one BKZ blocksize unit near beta 100.
Measured value
One entry per accepted reveal: normSq, recipient, commitIndex, commitBlock, revealBlock and keccak(f, g). normSq is computed from the same decoded integers the identity checks.
Uncertainty
A verifier bug is the realistic way to fake a record. Any entry can be challenged in its window: schoolbook multiplication runs on chain and, on a mismatch, freezes the rung.
Traceability
Every payload is in calldata and every accepted entry stores keccak(f, g), so anyone can re-check any record off chain.
Commit. c = keccak256("SIEVE/c/v1", chainid, hook, rootSeed, n, recipient, salt, keccak(f, g)) rides a buy of at least 0.01 ETH as hookData. The hook never reads sender or tx.origin; the payee is inside the hash, so a copied commit only registers the original payee.
Reveal. A standalone call from a later block than the commit, relayable by anyone, paying the recipient. No try/catch: a failed check reverts the reveal and touches nobody else's swap. Reveal through a private RPC, because a reverted reveal included on chain still publishes its payload.
The queue and the window. Each rung keeps a finalized record and a queue of pending entries, strictly decreasing. A pending entry e can be replaced by a vector N inside its 2% band only if N is a full step below e's predecessor, stays above e's successor, is strictly shorter than e (or equal with a lower commitIndex), and was committed before e was revealed. The replaced entry's window restarts. W = 300 blocks, about an hour.
Finalize. finalize(n) is permissionless and finalizes the head once block ≥ revealBlock + 300, strictly in index order. reveal, claim and poke finalize up to 4 matured heads first. A winner who never finalizes loses that inflow to earlier holders.
Freeze. If a challenge finds the fast check and schoolbook disagree, the rung freezes: no further entries, every pending entry is void, its lump and its future weight move to the other live rung. Finalized claims stand. This is a protocol-failure path, stated plainly.
Issued 2026-11-01Spec 4.1 to 4.4, 3.5; queue per ECON.md E3
SIEVE
2% step
SV-03
Certificate of calibration
The reward table Model
No.SV-04
Instrument
One immutable table per paid rung: breakpoints (normSqj, phij) every 5 beta, phi linear in normSq between them, 0 above the first.
Reference standard
phi(beta) = (20.30 (beta - 60) - 1) / (215 - 1) shares, so one share is beta 110 and each unit of blocksize multiplies the compute it stands for by 20.30, the cost model's own exponent. beta 60 is minutes on a laptop and mints 0 shares.
Measured value
None. This table is a model: the published GSA formula with the standard delta(beta) estimate. No measurement run was made (decided 2026-11-01). The table below is regenerated in your browser from that formula.
Uncertainty
The JS calibration showed the model is optimistic for the attacker at small blocksize in large q-ary dimension (at n = 128, BKZ-10 stayed at q where the model predicts 6,715 M). Above beta about 50 it was not tested here, and above about 120 nobody can test it cheaply. A wrong table shifts how much a step pays, never whether a false record is accepted.
Traceability
sieve/calib/ (calib.js, empirical.json), sieve/econ/ECON.md run 2, and the generator calib/table.js whose hash ships with the table.
How a rung pays. Each paid rung's inflow is split over its shares plus a virtual stake of 1 share that nobody owns. Holders earn dividends in proportion to their shares; the virtual stake's part feeds the lump. A finalizing step from record A to C pays lump - ceil(lump x (1 + phi(A)) / (1 + phi(C))) and mints phi(C) - phi(A) shares to the recipient. Splitting a step never pays more, and releasing a vector at once pays at least as much as dripping it out (ECON.md section 6).
| beta | n = 128 normSq | n = 256 normSq | phi (shares) | first record's lump take |
|---|
Alarm escrow. 5% of the pot, capped at 5 ETH; inflow above the cap goes to the two live rungs. Four one-off triggers, each paying 50% of the escrow at that moment: n = 512 below q2; n = 512 below 34,034,726 (Falcon-512's forgery bound); n = 1024 below q2; n = 1024 below 70,265,242 (Falcon-1024). It is expected never to pay.
Solvency. The hook's ERC-6909 ETH balance equals the owner's accrued fees, plus the pending pot slot, plus the escrow, the lumps, the dividend pools and everything claimable. Every liability is a slice of ETH already held; nothing is promised beyond the balance.
Issued 2026-11-01Spec 5.2 to 5.4 as amended by ECON.md run 2
MODEL
not a
measurement
Certificate of calibration
Gas
No.SV-05
Instrument
Every path a user or keeper runs, and every loop on it.
Reference standard
Ethereum's per-transaction cap, 16,777,216 gas. Nothing approaches it.
Measured value
The verifier prototype, called directly with a cold verifier and a cold h: 30,645 / 57,552 / 111,359 / 218,997 / 434,452 gas for n = 64 to 1024, worst valid payload M. 3.2x to 21.3x cheaper than schoolbook.
Uncertainty
The production hook adds the entry write, accrual and up to 4 finalizations. Every E on a user path becomes an M in gas_sieve.js before launch.
Traceability
sieve/proto/build/measured.json; spec tables 3.4 and 6.
| Path | Work | Gas | Label |
|---|
| Plain buy or sell | swap, fee delta, 6909 mint, one accrual write | 120k to 200k | E |
| Commit buy | plain buy plus one new commit slot | plain + about 25k | E |
| Reveal, standalone tx | verifier, entry write, accrual | 60,353 / 96,448 / 168,719 / 314,481 / 607,192 + 30k to 60k | M + E |
| finalize / claim / sweepOwner | O(1) bookkeeping | 60k to 100k | E |
| challenge (schoolbook) | n2 loop | 261,520 / 775,319 / 2,597,071 / 9,341,304 (n = 128 to 1024) | M |
| arm | drand BLS verify | about 130k | E |
| materialize(n) | expansion, NTT, code deposit | 122k / 213k / 400k / 792k / 1.61M | M (prototype) |
The swap path has no loop and no verifier. The worst case on a swap is the commit buy.
Issued 2026-11-01Spec sections 3.4 and 6
SIEVE
16,777,216
SV-05
Certificate of calibration
Attacks and residual risk
No.SV-06
Instrument
The attack table of the spec, as amended by the economics review.
Reference standard
An attack is closed when the residual risk column reads "none" or names a cost the attacker pays.
Measured value
All five verifiers accepted 50 of 50 valid vectors and rejected 114 of 114 invalid ones (19 kinds) at every n M. Forgery attempts outside the reviews: 0 of 8, 0 of 120, 0 of 80 accepted M.
Uncertainty
Both verifiers wrong in the same way is not covered.
Traceability
sieve/review/, sieve/proto/build/forge.json, sieve/econ/critic/.
| Attack | Mitigation | Residual |
|---|
| Unbounded k or t lets a false (f, g) pass | Width caps 14/14/24/40, exact length | None if coded as written |
| s omits a polynomial | s hashes every payload byte plus domain, chain, hook, rootSeed, n, recipient, salt | 2-164 at 280 queries |
| Opener or builder knows h early | drand round fixed in the future; commits bind rootSeed | League of Entropy threshold |
| Commit binds the router | Recipient and salt in the preimage; sender never read | None |
| Weaker vector front-runs a better one | Queue replacement inside the 2% band, earlier commit required | None found |
| Leaked payload copied or rotated | No try/catch; replacement needs a commit before the reveal; private RPC | A solver who never re-reveals loses the step |
| Step farming, rotations | 2% normSq step, strict comparison | A genuinely shorter recombination is real progress |
| Withholding and dripping | No lump share; ratio from phi; shares start at finalization | None without competitors (theorem) |
| Cheap capture of a quiet pot | Shares priced by compute; virtual stake | A first record on a quiet rung takes phi/(1 + phi) of the lump: 11% for about $2.65 of compute E |
| Verifier bug accepts a false record | Schoolbook challenge in the window freezes the rung | Both verifiers wrong the same way |
| Reentrancy during a swap | No ETH or external call on the swap path; pull claims; transient guard | None found |
| Pool initialized first by someone else | beforeInitialize gated to open(), price pinned | None |
| Owner trades against its own LP | Rewards never read the pool price | None |
| Locked funds on dead rungs | Only a capped 5% escrow | Up to 5 ETH, likely forever |
| drand outage | Re-pin to a later round after 7 days | Launch delay; no block entropy fallback by design |
Issued 2026-11-01Spec section 7, ECON.md E7
SIEVE
residual
SV-06
Certificate of calibration
Honest limits
No.SV-07
Instrument
The dial as a whole.
Reference standard
What a contract can measure: lattice-reduction capability by any means.
Measured value
An upper bound on the shortest vector known publicly in each rung. Not a measure of anyone's private capability.
Uncertainty
Stated in full below.
Traceability
Spec section 8; ECON.md section 12.
- The record measures how short a vector lattice reduction finds in Falcon's ring with no planted secret. Under the decisional NTRU assumption that a Falcon public key looks uniform, that is the hardness Falcon forgery rests on. It says nothing about key recovery (about BKZ-481 at n = 512 and 973 at n = 1024 E), which SIEVE does not test.
- Rungs 128 and 256 are not smaller Falcons: q = 12289 is above the overstretch point there, so a Falcon-shaped key at those sizes would be much weaker than SIEVE's uniform rung.
- The two rungs in Falcon's real dimensions are expected to read "no record" indefinitely. That is the honest reading of Falcon's margin, not a failure of the project.
- A record cannot show whether it came from a quantum device. The known quantum sieving gain moves core-SVP from 0.292 beta to 0.265 beta bits, about 1.10x the blocksize at equal budget, and assumes QRAM. No Shor-style collapse is known.
- The dial follows the pot. The model puts the day-365 record at beta 121 / 133 / 143 / 153 on rung 128 for 0.1 / 1 / 10 / 100 ETH a day of volume E. It measures what the pot pays for, not what anyone could do.
- The reward table is a model, published with the script that produced it.
- The negacyclic rotations give sieves up to about a factor n speedup. It shifts absolute numbers, not the order of the rungs.
- Up to 5 ETH can sit in the alarm escrow, likely forever.
- Ethereum is not moving to lattices. Its lean roadmap leans hash-based (leanSig, leanVM, FRI). Lattices appear as optional account signatures through draft precompiles (EIP-8051 ML-DSA, EIP-8052 Falcon-512), neither in Glamsterdam. Solana and Algorand chose Falcon over q = 12289. SIEVE scores that open bet. "Falcon-1024" here means Algorand's choice.
- All hook code is unaudited. The verifier is new code; the challenge path is the backstop.
Issued 2026-11-01Spec sections 8 and 9
SIEVE
limits
SV-07
Certificate of calibration
What is claimed as a first
No.SV-08
Instrument
Our own claims.
Reference standard
Prior art found on and off chain as of 2026-11-01.
Measured value
"As of 2026-11-01 we found no on-chain lattice challenge on any chain: no contract that verifies a short vector against a publicly seeded instance and pays for it." And: "the first lattice challenge whose instances come from public randomness fixed after deployment and whose records any contract can read."
Uncertainty
A search can miss things. The claim carries its date.
Traceability
The off-chain originals: TU Darmstadt's Lattice, SVP, Ideal Lattice and LWE challenges, and the NTRU challenges. Credited here.
Not claimed. The first cryptanalysis bounty (Peter Todd's P2SH bounties, 2013). The first hard-problem bounty contract (BloQBench RSA). The first lattice ladder (Darmstadt, since 2008). The first lattice proof of work (ePrint 2020/1362 and later work). The first on-chain Falcon arithmetic (ETHFALCON, Algorand, Starknet).
Not compared. The NTRU challenge record (n = 181, ePrint 2023/582) is a planted problem with a different q. The off-chain SVP frontier is cited only as latticechallenge.org shows it on launch day.
Issued 2026-11-01Spec section 9
SIEVE
dated
SV-08