Private cash · Layer 1

Money that keeps
quiet.

Kohl is a pure value-transfer chain. Privacy is mandatory at the protocol: no transparent balances, no smart contracts, no EVM. Value moves only as confidential outputs under full-chain membership spends.

View the code How privacy works

Consensus: RandomX PoW
Block time: 60 s
Genesis supply: Zero
Curve target: ~92M KOHL

Three pillars

What the chain hides — and how

Every transfer is self-authenticating. There is no account balance, no nonce, and no signed origin for user payments. The membership proof is the authorization.

Sender anonymity

Each spend proves the real input is one of the full set of mature outputs under a published Merkle root — not a wallet-chosen ring of decoys. Wallets do not sample mixins.

Hides which mature output moved · interim set size ≤ 64

Receiver privacy

Dual-key CryptoNote stealth addresses. Senders derive one-time destinations; only the view key can detect payment, only the spend key can unlock it. View tags keep wallet scanning fast.

Hides who was paid

Amount confidentiality

Amounts live inside Pedersen commitments. A public fee anchors the balance equation; aggregated Bulletproofs prove every output amount is in range — no overflow minting.

Hides how much moved

Design choices

Cash only. Fair launch. Honest limits.

No contracts, no EVM, no asset palette. The runtime is deliberately small: system, timestamp, RingCT, difficulty.
Zero genesis supply. Every coin is mined. RandomX PoW — no premine for the initial stake.
FCMP-only spends. One production path from genesis. No dual era of fixed-size rings on mainnet history.
Ristretto everywhere. Prime-order group avoids historical cofactor / small-subgroup footguns.
Native host crypto. Membership and Bulletproof verification run natively so block times stay practical under WASM.
Interim scale limit. Today’s proofs are O(n) over the mature set, capped at 64. Larger trees need a later log-size construction — we do not claim unlimited anonymity sets yet.

Transfer path

Wallet                         Runtime (pallet-ringct)
─────                         ──────────────────────
pick real output(s)
fetch membership root
  + leaf digests
build C' + FCMP proof
aggregated BP
stealth OTKs + masked amounts
unsigned extrinsic  ────────► shape / root window / fee
                              verify_fcmp (host)
                              ΣC' == ΣC_out + fee·H
                              verify range proof (host)
                              insert key images
                              append outputs + tree

Tokenomics

Monero-like emission, perpetual tail

Smooth decaying curve toward a long-run supply target, then a permanent tail reward so the security budget never hits zero.

Atomic unit 1e8 per 1 KOHL

Curve target 92M then slow growth

First block ~175 KOHL reward

Tail 0.3 KOHL / block forever

Block time 60s RandomX target

Coinbase lock 60 blocks maturity

Network privacy

Dandelion++ on by default. Tor still recommended.

On-chain privacy does not hide your IP. Kohl stems transactions before flooding them; operators should still route the node (and wallet RPC) over Tor for defence in depth.

Dandelion++

Local transfers enter a stem path on /kohl/dandelion/1, then fluff into ordinary gossip (~10% per hop, embargo fallback).

Built into the node

Outbound Tor

There is no --proxy-server flag. Use torsocks and bind P2P to localhost so dial-out goes through SOCKS.

Level 1 in the runbook

Onion services

Tor hidden service → 127.0.0.1:30333, advertise /onion3/… with --public-addr. Optional RPC onion for wallets.

Level 2–3 in the runbook

shell · outbound via Tor

torsocks ./target/release/kohl \
  --chain kohl-ash --validator \
  --listen-addr /ip4/127.0.0.1/tcp/30333 \
  --rpc-port 9944 \
  --network-backend libp2p \
  --mining-seed <64-hex>

Full runbook

kohl.network/run — public seed & miners
kohl.network/tor — Tor guide
production-bootnode.md

Prefer a remote full node you control. Third-party public RPC undoes much of your network privacy regardless of Tor.

Status

Pre-launch software that runs today

Privacy crypto, membership tree, FCMP spends, wallet builder, PoW node, and Dandelion++ against polkadot-stable2606. Mainnet is a fair launch when people choose to mine it — coordinate if you care about a shared start.

FCMP-only transfer (membership + balance + range proofs)
Path A membership tree + maturity via admission
Stealth addresses + view tags
Host-function crypto (native verify)
Runnable PoW node (--dev / kohl-ash / kohl)
Wallet scan + multi-input FCMP spends
Dandelion++ stem / fluff gossip
Encoding freeze docs · fuzz targets · benches

Log-size membership for trees larger than 64
Production RandomX (feature-gated today)
Longer public multi-node soak on shared history
Social mainnet launch coordination

Get started

Run a private cash node

shell · public seed (mainnet)

cargo build -p kohl-node --release

# One-time: node key + data dir
./scripts/setup-seed.sh

# Public seed — open TCP 30333; set your IP
PUBLIC_ADDR=/ip4/YOUR.PUBLIC.IP/tcp/30333 \
MINING_SEED=<64-hex> \
  ./scripts/run-seed.sh

# PeerId for bootnode string:
./target/release/kohl key inspect-node-key --file ./data/seed/node-key
# → /ip4/YOUR.PUBLIC.IP/tcp/30333/p2p/<PeerId>

# Optional: ship a chainspec with bootnodes embedded
./scripts/make-chainspec.sh --chain kohl \
  --bootnode /ip4/YOUR.PUBLIC.IP/tcp/30333/p2p/<PeerId> \
  --output chainspecs/kohl.json

Miners connect with

shell

BOOTNODE=/ip4/…/tcp/30333/p2p/… \
MINING_SEED=<64-hex> \
  ./scripts/run-miner.sh

# or: --chain ./chainspecs/kohl.json

Docs

Use --chain kohl (mainnet) or kohl-ash (testnet). Keep RPC on localhost; miners only need P2P port 30333. Software is experimental.

Build private money in the open.

Source under GPL-3.0. Read the code; run a node; decide for yourself.

github.com/iho/kohl