The path from your hash to a block.
Difficulty sets the odds on each hash, the same at every pool. These are the parts of the path the pool controls.
Checked before it leaves
Checked byte for byte
Before a block leaves for mainnet the pool checks it byte for byte: coinbase, commitment, payout, value.
Less work on an old block
Work on the new header
The pool moves your rig to a new block as soon as its node reports the new tip.
Back in seconds
If our node hiccups, the pool reconnects and serves fresh work in under ten seconds.
Stratum V1 and V2, one engine
Hardened Noise
Encrypted V2 that refuses nonce reuse, verifies every signature, and wipes its keys from memory.
Bounds first
The parser checks the length of each frame before it reads a field from it.
Real firmware, native
Bitaxe & NerdAxe run on extended channels with a deterministic per-channel extranonce.
Counted once
The pool credits each accepted share exactly once, on both protocols.
Floods and the block test
Limits on abuse
Per-IP caps, rate limits and slowloris timeouts hold off abuse. Over Stratum V1 the submit-rate limit applies to share credit after the block test, so a rig over its limit still gets a winning share submitted as a block.
Built to run unattended
Clean-room C core
An original C engine with a watchdog, a crash handler and an fsync journal. A solved block survives a crash or a restart.
Caps on memory
Memory caps and a difficulty engine that corrects itself keep the pool running without an operator at the keyboard.
Odds stated plainly
Difficulty sets the odds on each hash, the same at every pool. The landing page shows the expected time for your hashrate as an average, not a date.
You choose what goes in the block
AllocateMiningJobTokenYou ask for a token
The pool binds a token to your channel and hands back an identity for the job you are about to declare.
DeclareMiningJobYou name the transactions
You send the set you want inside the block. The pool records that set against your token.
ProvideMissingTransactionsOnly the gaps move
The pool asks for the transactions it does not already hold, by position. Nothing it has seen crosses the wire twice.
SetCustomMiningJobIt serves back your job
The work you receive is the job you declared, not a template the pool picked for you.
PushSolutionYou submit the header
The pool rebuilds the body from the set your token declared, then checks it byte for byte before it leaves.
It refuses rather than substitute
A declared job commits to your transaction set, so the body has to come from your set and nothing else. If your declaration ages past the retention window, the pool writes block.invalid reason=declared-set-evicted and stops. It will not assemble a body from its own template and send that instead, because a substituted body is not the block you solved.
The hot path, measured
Hardware SHA, chosen at runtime
The core reads cpuid and takes the hardware SHA-256 path when the machine offers one. The same binary still starts on a machine that does not, so there is no second build to keep straight. The hardware kernel was checked byte for byte against a separate implementation across four thousand inputs and fourteen length classes.
Counted once, whatever the casing
The duplicate check keys on the canonical share: binary extranonce, rolled version. Send the same share twice with the hex in a different case and both land on the same key, so the second one is rejected. A lookup touches about three slots with four thousand shares resident, where the old scan walked all four thousand.
One read, one write
epoll here is level triggered, so a short read already proves the socket is empty and the extra call that could only answer EAGAIN is gone. Events to the control plane leave in one write per pass of the event loop instead of one write each.
Same generator, same load, run back to back. Tip to work on the wire measures about four milliseconds at the median in production, taken from the core’s own timestamps.
What holds the claim up
Non-custodial by construction
Payment happens inside the block. The coinbase output pays the address in your worker username, so there is no balance to withdraw and no window where the pool holds your coin.
Read any block it finds and check the output against what you configured.
No reserves to audit
The pool never holds a coin, so there is nothing to prove reserves of. What you can audit is the work it counted: shares, difficulty served, best share and window, sealed at the moment they were written.
Each seal binds its own position in the journal, so no number in it moves afterwards.
A signature anyone can check
Every receipt carries a 64-byte BIP340 Schnorr signature over a domain-separated encoding of its sequence, type and payload. You verify it against a key you pinned yourself.
The standalone verifier will be a static binary with no network and no dependencies, so the check will not need this pool online, or honest, or still running. It is still in development.
The protocol lives in the daemon
Stratum V2 splits mining into roles. NexusPool is the pool role and implements it in the same C daemon that speaks V1, so nothing translates between your rig and the pool.
Pin the authority key and anything trying to answer for the pool fails the Noise handshake instead of dropping to plaintext.
Point a miner. See it for yourself.
The proof you can hold is the Glass Ledger: a signature for the work the pool counted, which you check on your own machine.