A hearth on Solana, lit only by Zcash block headers. Zcash is the clock, the proof system and the colour. The fire never goes down.
one settlement, drawn left to right · every redraw is a new hand
1 · header
Anyone submits a raw Zcash block header. The program checks the Equihash solution and the difficulty target itself. No oracle.
2 · σ
The height fixes where Zcash is on its halving schedule. σ is the fraction of the 21 M cap already issued.
3 · cycle
Fees split by σ. The share that locks goes to the Vesta hearth. The rest stays as Pallas depth. Each curve is the field the other computes in.
4 · hearth
Coins burn on every settlement and SOL only enters the hearth. F, locked SOL per surviving coin, steps up and never down.
§ 1
Why it is called Vesta
Zcash proves its shielded transactions with Halo 2. Halo 2 runs on a pair of elliptic curves named Pallas and Vesta. They form a cycle: the number of points on Pallas is the size of the field Vesta is drawn over, and the other way round. Neither curve is defined without the other.
That is the whole design in one object. Vesta the protocol has two halves, and each is the ground the other stands on. The open liquidity curve produces fees. The fees become the locked base of the hearth. The hearth produces a floor. The floor is the number the liquidity curve prices against.
The name is also older than cryptography. Vesta is the Roman keeper of the hearth. Her fire was tended so it would not go out, and a city measured its continuity by it. The one invariant this program enforces is the same sentence: the fire does not go down.
Gold on these pages is Zcash's gold. Everything drawn in it is either Zcash itself or the part of Vesta that keeps. Everything in grey is the open side, Pallas, and the plumbing.
PALLAS · Fp
The open curve. Public liquidity, quoted continuously, fees accrue here. Its scalar field is Vesta's base field.
VESTA · Fq
The hearth. SOL enters on every settlement and never leaves. Its scalar field is Pallas's base field.
σ(h)
Issued fraction of Zcash at block height h, read from the header, not from a price feed. Rises in halving steps toward 1.
F
Locked SOL divided by surviving coin supply. The only number the program promises anything about.
§ 2
The cycle, drawn as fields
A curve over a field Fp has some number q of points. If you can find a second curve over Fq that has exactly p points, the two curves close into a loop. Pallas and Vesta are such a loop, which is why Halo 2 can fold a proof inside a proof without ever leaving the pair.
Vesta borrows the shape, not the arithmetic. The split rule takes the fees produced on the open side and sends the σ share into the hearth. The hearth is not an account, it is a program-owned vault with no withdraw instruction. The floor it implies is exposed back to the open side as the lowest price the curve will quote.
Because σ only moves at Zcash halvings, the split rule is a step function of Zcash's own clock. Nobody votes on it. When Zcash has issued everything, σ is 1, and every fee locks.
plate bThe curve cycle Halo 2 runs on, and the protocol mapping laid under it. The arrows are the same arrows.
§ 3
The hearth and the one invariant
Fn+1 ≥ Fn for every settlement n. Locked SOL per surviving coin never decreases.
Two things happen at a settlement and both push F the same way. SOL enters the hearth and cannot leave, so the numerator can only grow. A portion of coins is burned, so the denominator can only shrink. There is no instruction in the program that moves either quantity the other way.
That makes F a floor rather than a promise. Any holder can at any time redeem against the hearth at exactly F, which is why the open curve never quotes below it. The market may trade far above F. It cannot trade below it for longer than it takes one arbitrageur to notice.
The flame in the header sketch is not decoration. It marks the number the whole design exists to protect.
plate cF only steps up. Price may wander above it, never below.
§ 4
The clock is Zcash's, not ours
σ is read from block height, and block height is read from a header whose proof of work the program verifies. That is the only external input. There is no price feed, no keeper, no multisig that can set σ by hand.
Since the Blossom upgrade Zcash targets a 75 second block and halves every 1 680 000 blocks. The cap is 21 000 000, the same as Bitcoin's. σ is therefore a known staircase into the future, and the split rule is known with it. Anyone can compute what the hearth will be taking in 2032.
When a halving passes on Zcash, the next valid header submitted to Vesta moves σ. The protocol changes its own behaviour on the day Zcash changes, and on no other day.
halving
zcash height
approx. date
block reward
σ after
1st
1 046 400
Nov 2020
6.25 → 3.125
0.50
2nd
2 726 400
Nov 2024
3.125 → 1.5625
0.75
3rd
4 406 400
~2028
1.5625 → 0.78125
0.875
4th
6 086 400
~2032
0.78125 → 0.390625
0.9375
…
…
…
→ 0
→ 1
σ after a halving is the schedule's cumulative issuance over 21 M. Today sits between the 2nd and 3rd steps, so σ ≈ 0.81 in the header sketch is the live value at height 3 504 000, not a round number.
§ 5
Lineage: from Locus to Vesta
LOCUS · 2025
Two proof-of-work chains as the foci of one ellipse. Bitcoin and Zcash headers set the eccentricity. A point on the curve moves with fees and decides burn versus liquidity. Settled on Solana.
keeps the invariant, changes the geometry →
VESTA · 2026
One chain, Zcash, as the clock. Two curves in a cycle instead of two foci on a curve. The split is a step function of Zcash's halving schedule. Same F, same promise that it never decreases.
Locus needed two chains because an ellipse needs two foci. Vesta needs one chain because a cycle of curves is already two objects. Removing Bitcoin removes an input, a header format and a second set of verification code. What remains is the smallest thing that still has the property Locus was built for.
§ 6
Open notes, draft 0.1
Eight things are undecided. Each one can move the mechanism, so none of them is a detail to be settled later by whoever writes the instruction. The notebook behind these cards has the reasoning that got the rest of the design to where it is.
BURN RATE
How many coins burn per settlement is not fixed. Proportional to fees keeps the burn honest but ties it to volume. Proportional to 1−σ makes the burn fade exactly as issuance ends, which hands the late years entirely to the lock.
HEADER PROOF
Equihash (200,9) is 512 hashes per verification, well past one Solana instruction's compute budget. Either split it across instructions, or accept a Halo 2 proof that the verification happened, which would make the name literal.
REDEEM
Redeeming exactly F burns one coin and removes F of SOL, which leaves F unchanged. That is what makes the floor safe to open to everyone. Any redemption above F drains the hearth, so the rate is not a parameter.
FEE SOURCE
Fees come from the Pallas side. Which pairs quote there, and whether the protocol runs the market itself or rents depth from an existing one, decides whether the hearth is fed by its own volume or someone else's.
REORG DEPTH
A header counts only after n confirmations. Zcash reorgs are shallow, but 100 blocks is two hours at a 75 second target. Too shallow and σ can move on a chain that loses. Too deep and the clock lags.
FIRST FIRE
F starts at zero, and a floor of zero is not a floor. Either seed the hearth before anyone can hold a coin, or let the first settlements run with redemption closed until F clears a threshold worth quoting.
σ = 1
After the last halving every fee locks and nothing stays as depth. The open side dries up at the moment the hearth is fullest. This needs an answer long before it needs a launch.
NAME · DOMAIN
Coin and protocol are both Vesta. Ticker VESTA. Primary domain vestahalving.com in the Locus pattern, verified unregistered. Pallas stays a component name and never becomes the brand.
working notebook · vesta · how the sketch was arrived at
2026 · 08 · 02
does the second chain earn its place?
Locus put Bitcoin and Zcash at the two foci and took the eccentricity from the difference of their issued fractions. That was the whole reason for having two chains.
keep both, the ellipse needs two foci
Look at what the difference actually does. Both chains cap at 21 million and both halve on a fixed schedule, so the two fractions run almost parallel for the entire window I care about.
Across 2024 to 2032 the gap moves from roughly six hundredths to four. Two header formats, two proof-of-work verifiers, two sets of reorg rules, to move one parameter by two hundredths.
the second chain was paying rent in code and returning noise.
So Bitcoin comes out. Zcash stays, because Zcash is the one carrying the proof system I want to take the geometry from.
decision · one chain for the clock. the second object comes from the curve pair, not from a second chain.
2026 · 08 · 09
where σ is allowed to come from
σ decides how much of every fee is locked forever. That makes σ the only number an attacker would bother to move, so it has to come from somewhere nobody can reach.
Ruled out, in the order I ruled them out:
a price feedsomeone has to be trusted, and the someone is usually me.
a TWAP on the Pallas sidethe thing it measures is the thing it controls.
block timestampminers write it, with hours of slack.
a governance votethen the invariant is a promise, not a property.
What survives is height. Height is the one field in a header that cannot be raised without paying for the work that raising it costs, and the program checks that payment itself.
σ(h) = issued(h) / 21 000 000, issued(h) = Σ over eras of (blocks × reward)
this is the whole trick. everything after it is bookkeeping.
It also means the future is public. Anyone can compute the split rule for 2032 today, because Zcash already published it.
2026 · 08 · 17
why F cannot fall
Write it out properly. L is locked SOL, S is surviving supply, F = L / S. A settlement adds λ to L and burns β from S, both non-negative.
That is the entire theorem and it is one line. All the real work is making sure no instruction in the program can produce a negative λ or β. There is no withdraw. There is no mint.
redemption pays out of the hearth, so L falls. this breaks the proof.
It does not break it, and finding out why cost a day. If a redeemer burns one coin and takes exactly F, then L falls by F and S falls by one:
(L − L/S) / (S − 1) = L/S = F unchanged
Redemption at the floor is exactly neutral to the invariant. That is why it can be open to everyone with no queue, no cap and no cooldown.
redeem at F costs the invariant nothing. anything above F drains it. so the rate is not a dial, it is the definition.
2026 · 09 · 03
the name log
What the name had to do: say the mechanism to someone who knows Zcash, say nothing embarrassing to someone who does not, and survive being printed next to a price.
Rho (ρ)the note field carrying its parent's nullifier. correct, and used to death.
Zetaa dozen of them already.
Nullifierreads like a loss.
AnchorTerra.
Apsis, Cuspgood words. no Zcash anywhere in them.
Vesta clears all three. Halo 2 runs on a cycle of two curves, Pallas and Vesta, and those curves were built for Orchard, the shielded pool. The name is already inside Zcash rather than borrowed from beside it.
And Vesta keeps a fire that is not allowed to go out, which is the invariant written in Latin instead of algebra. Same sentence twice.
ticker VESTA. domain vestahalving.com, Locus pattern, checked unregistered. Pallas stays a component name, never the brand.
2026 · 09 · 22
still open
□ Equihash on Solana. 512 hashes per verify is past one instruction's compute budget. Split it, or prove it with Halo 2 and make the name literal.
□ First fire. F starts at zero and a floor of zero is not a floor. Seed the hearth, or keep redemption shut until F is worth quoting.
□ Reorg depth. Shallow and σ can move on a chain that loses. Deep and the clock lags by hours.
□ σ = 1. The open side dries up exactly when the hearth is fullest. No answer yet, and this one is structural.
☑ Burn on settle is non-negotiable. Without it the denominator never moves and F only grows by deposits.
next: write the settlement instruction and count compute units before drawing anything else.
rule for this notebook · nothing goes on the front page until it is derived on a leaf in here.