KHROME Tokenomics v2 — Mainnet Allocation With the Investor Bucket Reinstated
Status: DRAFT for counsel and investor review — 2026-10-04. Nothing in this document is on chain. The live chain (777001) is a public beta on a testnet-grade genesis; mainnet is a clean relaunch (§5). This is not an offer to sell tokens or securities.
Supersedes the §6 "Raise: deferred" decision in
docs/l1/10-mainnet-genesis-allocation.md.
That doc folded the 12% Investor bucket into Treasury because no raise was
planned. The founder has now decided to raise. The seven-bucket
allocation from doc 10 §1 is therefore reinstated unchanged in size. What
v2 adds: the vesting/cliff schedules for every bucket, the sub-buckets
inside Community and Investors, a 48-month unlock table, and an explicit
statement of how the current testnet premine is discarded.
1. Supply model in one paragraph
777,000,000 KHROME at mainnet genesis. Under the zero-point monetary
policy (docs/superpowers/specs/2026-06-20-zero-point-monetary-policy-design.md)
777M is a supply setpoint, not a hard cap: a MonetaryController would
issue a small per-block floor and EIP-1559 burn would pull supply down.
That controller is not live. It has been shown working on a local devnet
built on a custom reth (DEVNET-PROOF.md), and it is not deployed on chain
777001. Turning it on means every validator switches to the custom client
binary, which is consensus-critical. Until it ships, the only supply is
the genesis allocation below. The schedule in §4 covers that allocation
and nothing else.
2. Allocation (777,000,000 KHROME)
| # | Bucket | % | KHROME | Holder at genesis | Unlock schedule (summary) |
|---|---|---|---|---|---|
| 1 | Treasury / Foundation | 25% | 194,250,000 | KhromeVestingWallet → Treasury Safe (2-of-3, 48h timelock) |
10% at genesis; 90% linear over 48 months |
| 2 | Ecosystem & Grants | 20% | 155,400,000 | KhromeVestingWallet → Ecosystem Safe (2-of-3, 48h timelock) |
5% at genesis; 95% linear over 48 months |
| 3 | Team & Founders | 18% | 139,860,000 | Per-beneficiary KhromeVestingWallet (unallocated reserve held in Team Safe, same schedule) |
12-month cliff (25% at month 12), then monthly to month 48 |
| 4 | Validator & Staking Rewards | 15% | 116,550,000 | ValidatorRewards contract |
3% of remaining pool per 30-day period (contract-enforced, no admin withdrawal) |
| 5 | Investors / Strategic | 12% | 93,240,000 | Per-investor KhromeVestingWallet |
12-month cliff, then 24 months linear (fully vested month 36) |
| 6 | Community | 7% | 54,390,000 | Distribution Safe + node-license reward contract | See §2.2 |
| 7 | Liquidity | 3% | 23,310,000 | Liquidity Safe | 50% at genesis, 50% at month 3 (alongside the LBP) |
| Total | 100% | 777,000,000 |
Sum check, which supply_schedule.py asserts in code: 194,250,000 + 155,400,000 +
139,860,000 + 116,550,000 + 93,240,000 + 54,390,000 + 23,310,000 =
777,000,000.
Control at genesis: founder + foundation (Treasury + Team + Ecosystem) is 63% of supply, the same as doc 10. The difference from doc 10 is that v2 locks every founder/foundation bucket in on-chain vesting (spec C decision D-C8: "enforced by math, not by foundation goodwill"). Treasury and Ecosystem no longer get a fully unlocked multisig balance at genesis.
2.1 Investor bucket — 93,240,000 (12%)
| Sub-bucket | % of supply | KHROME | Use |
|---|---|---|---|
| Seed (SAFE + token warrant / side letter) | 8% | 62,160,000 | First raise (pre-seed/seed + accelerators). Terms in term-sheet-draft.md |
| Strategic reserve | 4% | 31,080,000 | Later strategic investors or accelerator follow-ons on the same instrument |
- Vesting: 12-month cliff from mainnet genesis (TGE), with nothing unlocked
through month 12. After that, 1/24 per month for months 13–36. Enforced
by
KhromeVestingWallet(OpenZeppelinVestingWalletCliffcomposition), one wallet per investor, with no admin acceleration path. It is parameterised asstart = TGE + 12 months,duration = 24 months,cliff = 0. The contract vests per second; the table in §4 shows month-end values. - Delivery formula: an investor's tokens = their fully-diluted equity % × the Equity-Holder Token Pool. The pool is the Team bucket plus the Investor bucket: 30% of supply, 233,100,000 KHROME. Deliveries come out of the Investor bucket and can never add up to more than 93,240,000. Full mechanics are in the term sheet §4.
- Unsold remainder: anything not committed to a signed investor by genesis reverts to Treasury, following doc 10 §3.5. It is never parked at a placeholder address and never re-sold off-schedule.
- No side letters with refund, put, or early-unlock rights. If a side
letter exists, it is disclosed. This is a hard rule (see
README.md, red flag R7).
2.2 Community bucket — 54,390,000 (7%)
| Sub-bucket | % of supply | KHROME | Schedule |
|---|---|---|---|
| Testnet / points airdrop | 2.5% | 19,425,000 | 50% claimable at genesis, 50% linear over months 1–6 |
| Node-license reward pool | 3.0% | 23,310,000 | Emitted linearly over 36 months to license holders whose nodes meet uptime rules |
| Community sale / LBP | 1.5% | 11,655,000 | Sold in a post-mainnet community sale or LBP (modelled at month 3), unlocked at sale |
- Airdrop eligibility will come from a published snapshot rule set:
testnet transactions, bridge use, KhromeDrive use, and verified bug reports.
Every airdrop claim is screened through
SanctionsScreen. - Node-license rewards go only to licenses sold in the node-license sale (README step 5, Reg S / 506(c) only). Rewards are paid for running a node that meets published uptime rules, not for holding the license. Counsel must sign off on the reward mechanics before any license is sold (see term-sheet questions Q9–Q11).
- Community sale / LBP happens only after mainnet, the external audit,
and counsel sign-off. Geofencing and KYC go through the sale contracts' eligibility
attestations (
contracts/src/sale/EligibilityVerifier.sol, currently being built in this branch).
2.3 Treasury and Ecosystem — "Safe + timelock with a disclosed schedule"
The genesis portion of each bucket goes straight to its Safe: 10% of
Treasury and 5% of Ecosystem. The remainder (90% and 95%) is funded into a
KhromeVestingWallet whose beneficiary is that Safe, with a 48-month
linear vest and no cliff. The unlock schedule is enforced on chain. Unlocked
tokens sit in the Safe.
Spending them requires:
- a 2-of-3 Safe signature on hardware keys (
docs/l1/15-launch-execution.md), and - a 48-hour
TimelockControllerdelay, so every outflow is public for two days before it executes (docs/l1/13-security-model.md§6).
The disclosed treasury policy (spec C D-C9): publish the Safe addresses; make any single outflow above 1,000,000 KHROME a public on-chain proposal through the timelock; and post a quarterly treasury report. The unlock schedule is the maximum that can be spent. Unspent tokens stay in the Safe and are not circulating in practice.
2.4 Team — 139,860,000 (18%)
Solo founder today. After genesis the founder's tokens go into one
KhromeVestingWallet with a 12-month cliff and a 48-month total vest. The
rest is a hiring reserve that stays in the Team Safe on the same
schedule, so a future hire's grant can never vest faster than the bucket.
The founder's tokens vest like everyone else's. There is no exemption.
2.5 Validator rewards — 116,550,000 (15%)
ValidatorRewards (docs/l1/11-validator-rewards.md). The parameters are
locked: periodDuration = 30 days, decayBps = 300. The admin can call
start() and rotate itself. It cannot move funds, and this is proven by
ValidatorRewards.adminNoFundMovement.t.sol. About 31% of the pool pays out
in year 1, about 77% by month 48, and about 97% within 10 years. On today's
testnet the contract is deployed at 0x7deEb51540d6E473742DdcB61C6061f04D545b2a.
It is unfunded and not started (balance 0, started() == false, checked
on chain 2026-10-04).
3. Current testnet premine — how it is discarded
| Fact (verified on chain 2026-10-04) | Value |
|---|---|
| Chain | 777001 public beta, genesis 2026-05-25 (genesis_time 1779709290) |
| Premine holder | Trezor 0x34660b0942cDa83AeE0b2E9051092A1B0340C2A4 |
| Balance | ≈ 999,995,000 KHROME (on-chain read: 999,995,001) |
| Vesting | None |
The testnet premine does not carry over to mainnet. Mainnet is a fresh
genesis: new genesis.json, new genesis.ssz, and a new validator mnemonic
generated air-gapped (doc 10 §5, step 2). Its alloc holds only the bucket
addresses in §2. No balance from chain 777001 is snapshotted, migrated, or
honoured, and that includes the Trezor's ≈999,995,000 testnet KHROME. The
testnet's "1B supply" figure has no relation to the mainnet's 777M.
Two loose ends must be closed before the raise is marketed, so that no investor can mistake testnet KHROME for something with value:
- The bridge.
BridgedKHROMEon Ethereum mainnet (0x6E34DBcFa8ae7EEBE73365d7439305Cd3E5d68F6) is minted against testnet KHROME that gets locked inKhromeBridgeon 777001. Any BridgedKHROME in circulation is therefore backed by testnet coin. On-chaintotalSupply()on 2026-10-04 was 0.15 BridgedKHROME, so the exposure is tiny today, which makes this the cheapest moment to settle it. Before mainnet, the founder must publish its total supply and holders, and pick a written policy. The options are (a) pause the bridge and announce BridgedKHROME is retired at mainnet, or (b) redeploy a new mainnet-backed bridge token. Any 1:1 migration of testnet-backed BridgedKHROME into mainnet KHROME needs counsel review first. It would bring the discarded premine back in through a side door. Default: (a). - Public statement. Publish a short notice on the docs site and the data room saying testnet KHROME has no value and is not convertible.
The chain ID question (doc 10 §5 step 6 keeps 777001 for mainnet) is
open: a different mainnet chain ID (for example 777000) would stop wallets
and the bridge from confusing testnet with mainnet. This is listed as an
engineering decision in README §4.
4. Monthly unlock schedule, months 0–48
Generated by supply_schedule.py
(python3 docs/raise/supply_schedule.py). The CSV is at
supply_schedule.csv. Month 0 is mainnet genesis (TGE), and one
month is one 30-day ValidatorRewards period. Values are whole KHROME, rounded down.
How to read "Unlocked total". It is the upper bound on circulating supply. It counts every token that vesting no longer locks, including Treasury and Ecosystem tokens that have unlocked into a Safe but have not been spent. Validator rewards are counted as emitted, which assumes the contract is funded at genesis and the first validator enrols at month 0.
| Mo | Treasury | Ecosystem | Team | Validator rewards | Investors | Community | Liquidity | Unlocked total | % of 777M |
|---|---|---|---|---|---|---|---|---|---|
| 0 | 19,425,000 | 7,770,000 | 0 | 0 | 0 | 9,712,500 | 11,655,000 | 48,562,500 | 6.25% |
| 1 | 23,067,187 | 10,845,625 | 0 | 3,496,500 | 0 | 11,978,750 | 11,655,000 | 61,043,062 | 7.86% |
| 2 | 26,709,375 | 13,921,250 | 0 | 6,888,105 | 0 | 14,245,000 | 11,655,000 | 73,418,730 | 9.45% |
| 3 | 30,351,562 | 16,996,875 | 0 | 10,177,961 | 0 | 28,166,250 | 23,310,000 | 109,002,649 | 14.03% |
| 4 | 33,993,750 | 20,072,500 | 0 | 13,369,122 | 0 | 30,432,500 | 23,310,000 | 121,177,872 | 15.60% |
| 5 | 37,635,937 | 23,148,125 | 0 | 16,464,549 | 0 | 32,698,750 | 23,310,000 | 133,257,361 | 17.15% |
| 6 | 41,278,125 | 26,223,750 | 0 | 19,467,112 | 0 | 34,965,000 | 23,310,000 | 145,243,987 | 18.69% |
| 7 | 44,920,312 | 29,299,375 | 0 | 22,379,599 | 0 | 35,612,500 | 23,310,000 | 155,521,786 | 20.02% |
| 8 | 48,562,500 | 32,375,000 | 0 | 25,204,711 | 0 | 36,260,000 | 23,310,000 | 165,712,211 | 21.33% |
| 9 | 52,204,687 | 35,450,625 | 0 | 27,945,070 | 0 | 36,907,500 | 23,310,000 | 175,817,882 | 22.63% |
| 10 | 55,846,875 | 38,526,250 | 0 | 30,603,218 | 0 | 37,555,000 | 23,310,000 | 185,841,343 | 23.92% |
| 11 | 59,489,062 | 41,601,875 | 0 | 33,181,621 | 0 | 38,202,500 | 23,310,000 | 195,785,058 | 25.20% |
| 12 | 63,131,250 | 44,677,500 | 34,965,000 | 35,682,672 | 0 | 38,850,000 | 23,310,000 | 240,616,422 | 30.97% |
| 13 | 66,773,437 | 47,753,125 | 37,878,750 | 38,108,692 | 3,885,000 | 39,497,500 | 23,310,000 | 257,206,505 | 33.10% |
| 14 | 70,415,625 | 50,828,750 | 40,792,500 | 40,461,931 | 7,770,000 | 40,145,000 | 23,310,000 | 273,723,806 | 35.23% |
| 15 | 74,057,812 | 53,904,375 | 43,706,250 | 42,744,573 | 11,655,000 | 40,792,500 | 23,310,000 | 290,170,511 | 37.34% |
| 16 | 77,700,000 | 56,980,000 | 46,620,000 | 44,958,736 | 15,540,000 | 41,440,000 | 23,310,000 | 306,548,736 | 39.45% |
| 17 | 81,342,187 | 60,055,625 | 49,533,750 | 47,106,474 | 19,425,000 | 42,087,500 | 23,310,000 | 322,860,537 | 41.55% |
| 18 | 84,984,375 | 63,131,250 | 52,447,500 | 49,189,780 | 23,310,000 | 42,735,000 | 23,310,000 | 339,107,905 | 43.64% |
| 19 | 88,626,562 | 66,206,875 | 55,361,250 | 51,210,586 | 27,195,000 | 43,382,500 | 23,310,000 | 355,292,774 | 45.73% |
| 20 | 92,268,750 | 69,282,500 | 58,275,000 | 53,170,769 | 31,080,000 | 44,030,000 | 23,310,000 | 371,417,019 | 47.80% |
| 21 | 95,910,937 | 72,358,125 | 61,188,750 | 55,072,146 | 34,965,000 | 44,677,500 | 23,310,000 | 387,482,458 | 49.87% |
| 22 | 99,553,125 | 75,433,750 | 64,102,500 | 56,916,481 | 38,850,000 | 45,325,000 | 23,310,000 | 403,490,856 | 51.93% |
| 23 | 103,195,312 | 78,509,375 | 67,016,250 | 58,705,487 | 42,735,000 | 45,972,500 | 23,310,000 | 419,443,924 | 53.98% |
| 24 | 106,837,500 | 81,585,000 | 69,930,000 | 60,440,822 | 46,620,000 | 46,620,000 | 23,310,000 | 435,343,322 | 56.03% |
| 25 | 110,479,687 | 84,660,625 | 72,843,750 | 62,124,098 | 50,505,000 | 47,267,500 | 23,310,000 | 451,190,660 | 58.07% |
| 26 | 114,121,875 | 87,736,250 | 75,757,500 | 63,756,875 | 54,390,000 | 47,915,000 | 23,310,000 | 466,987,500 | 60.10% |
| 27 | 117,764,062 | 90,811,875 | 78,671,250 | 65,340,668 | 58,275,000 | 48,562,500 | 23,310,000 | 482,735,356 | 62.13% |
| 28 | 121,406,250 | 93,887,500 | 81,585,000 | 66,876,948 | 62,160,000 | 49,210,000 | 23,310,000 | 498,435,698 | 64.15% |
| 29 | 125,048,437 | 96,963,125 | 84,498,750 | 68,367,140 | 66,045,000 | 49,857,500 | 23,310,000 | 514,089,952 | 66.16% |
| 30 | 128,690,625 | 100,038,750 | 87,412,500 | 69,812,626 | 69,930,000 | 50,505,000 | 23,310,000 | 529,699,501 | 68.17% |
| 31 | 132,332,812 | 103,114,375 | 90,326,250 | 71,214,747 | 73,815,000 | 51,152,500 | 23,310,000 | 545,265,684 | 70.18% |
| 32 | 135,975,000 | 106,190,000 | 93,240,000 | 72,574,804 | 77,700,000 | 51,800,000 | 23,310,000 | 560,789,804 | 72.17% |
| 33 | 139,617,187 | 109,265,625 | 96,153,750 | 73,894,060 | 81,585,000 | 52,447,500 | 23,310,000 | 576,273,123 | 74.17% |
| 34 | 143,259,375 | 112,341,250 | 99,067,500 | 75,173,738 | 85,470,000 | 53,095,000 | 23,310,000 | 591,716,863 | 76.15% |
| 35 | 146,901,562 | 115,416,875 | 101,981,250 | 76,415,026 | 89,355,000 | 53,742,500 | 23,310,000 | 607,122,214 | 78.14% |
| 36 | 150,543,750 | 118,492,500 | 104,895,000 | 77,619,076 | 93,240,000 | 54,390,000 | 23,310,000 | 622,490,326 | 80.11% |
| 37 | 154,185,937 | 121,568,125 | 107,808,750 | 78,787,003 | 93,240,000 | 54,390,000 | 23,310,000 | 633,289,816 | 81.50% |
| 38 | 157,828,125 | 124,643,750 | 110,722,500 | 79,919,893 | 93,240,000 | 54,390,000 | 23,310,000 | 644,054,268 | 82.89% |
| 39 | 161,470,312 | 127,719,375 | 113,636,250 | 81,018,796 | 93,240,000 | 54,390,000 | 23,310,000 | 654,784,734 | 84.27% |
| 40 | 165,112,500 | 130,795,000 | 116,550,000 | 82,084,732 | 93,240,000 | 54,390,000 | 23,310,000 | 665,482,232 | 85.65% |
| 41 | 168,754,687 | 133,870,625 | 119,463,750 | 83,118,690 | 93,240,000 | 54,390,000 | 23,310,000 | 676,147,753 | 87.02% |
| 42 | 172,396,875 | 136,946,250 | 122,377,500 | 84,121,630 | 93,240,000 | 54,390,000 | 23,310,000 | 686,782,255 | 88.39% |
| 43 | 176,039,062 | 140,021,875 | 125,291,250 | 85,094,481 | 93,240,000 | 54,390,000 | 23,310,000 | 697,386,668 | 89.75% |
| 44 | 179,681,250 | 143,097,500 | 128,205,000 | 86,038,146 | 93,240,000 | 54,390,000 | 23,310,000 | 707,961,896 | 91.11% |
| 45 | 183,323,437 | 146,173,125 | 131,118,750 | 86,953,502 | 93,240,000 | 54,390,000 | 23,310,000 | 718,508,814 | 92.47% |
| 46 | 186,965,625 | 149,248,750 | 134,032,500 | 87,841,397 | 93,240,000 | 54,390,000 | 23,310,000 | 729,028,272 | 93.83% |
| 47 | 190,607,812 | 152,324,375 | 136,946,250 | 88,702,655 | 93,240,000 | 54,390,000 | 23,310,000 | 739,521,092 | 95.18% |
| 48 | 194,250,000 | 155,400,000 | 139,860,000 | 89,538,075 | 93,240,000 | 54,390,000 | 23,310,000 | 749,988,075 | 96.52% |
Verification: - buckets sum = 777,000,000 KHROME == 777,000,000 OK - community + investor sub-buckets sum to their parents OK - every non-validator bucket is exactly 100% unlocked by month 48 OK - all curves monotone non-decreasing OK - month 48 (exact wei): unlocked 749,988,075.781974 + still locked in ValidatorRewards 27,011,924.218026 = 777,000,000 OK - CSV written: docs/raise/supply_schedule.csv
Key points:
- At genesis, 6.25% (48.56M) is unlocked: Treasury 10%, Ecosystem 5%, half the airdrop, and half of Liquidity. None of it belongs to team or investors.
- Month 12 is the first team unlock (25% of Team). Investors' first unlock is month 13. No insider token is liquid in year 1.
- Month 36: investors fully vested. Month 48: every bucket except
Validator rewards is fully unlocked. About 27.0M KHROME is still in
ValidatorRewards, emitting on its decay curve.
5. Comparison with doc 10
| Item | doc 10 (§6, raise deferred) | v2 (raise decided) |
|---|---|---|
| Investor bucket | Folded into Treasury (Treasury = 37%) | Reinstated: 12%, per-investor vesting |
| Investor vesting | 6-mo cliff, 2-yr vest | 12-mo cliff, then 24-mo linear (fully vested month 36) |
| Treasury / Ecosystem | Fully unlocked multisig at genesis | On-chain vesting wallet → Safe + 48h timelock |
| Community | Event-based Safe releases | Split: airdrop / node-license rewards / community sale |
| Team | 4-yr, 1-yr cliff | Unchanged (12-mo cliff / 48-mo vest) |
| Validator rewards | 15%, 30d / 300 bps | Unchanged |
Genesis alloc entries |
6 | Up to 7 bucket addresses + per-investor vesting wallets (CREATE2) |
6. Open items, all human- or counsel-gated
- Treasury and Ecosystem unlock percentages (10% / 5% at genesis) are proposals. Confirm them with counsel and the first lead investor.
- Equity-Holder Token Pool definition (Team + Investors = 30%): confirm with counsel (term sheet Q3).
- Node-license reward mechanics: counsel sign-off before any sale (term sheet Q9–Q11).
- MonetaryController activation: if it goes live, the per-block floor issuance (simulated at about 1%/yr) is added on top of this table, and the table must be regenerated with that issuance included.
- BridgedKHROME disposition (§3): founder decision plus counsel.