The EKG Protocol

Every token protocol that promises a price floor eventually meets the moment where keeping the promise costs somebody money, and then the promise is only as good as whoever has to keep it. EKG promises nothing about price. It promises behaviour: seven percent of every commit goes to the open market and buys the token back, the supply only falls, and no owner exists who could decide otherwise.

01What it is

You send PLS to the Mine and receive EKG at the going rate. Ninety percent of what you sent comes back to you twenty four hours later, so the real cost of a token is a tenth of its headline price. The ten percent the protocol keeps is split the moment you mine: seventy percent into the buy and burn, twenty to holders, ten to operations. Against the whole commit that is 90, 7, 2 and 1.

The buy and burn is a separate contract. It queues that PLS, and anyone may call it to spend the queue buying EKG on PulseX and destroying what it buys. It has no withdraw function, no owner, no pause, and only the Mine may put PLS into it.

The holders' share goes out before the new tokens are minted. That detail is not cosmetic. Pay it afterwards and the miner receives a slice of their own payment back, which drops the real round trip cost from three percent to one and turns mining into free money for anyone larger than the flow. Paying first makes mining and dumping cost money, which is what it should do.

02The launch: pool first, mining after

Mining is closed at deployment. Every call to mine() or mineExact() reverts NotOpen until the launch function has run, and the launch function creates the market. There is no configuration in which EKG can be mined against a pool that does not exist, and therefore no moment at which the buy and burn holds money with nothing to buy.

openMine(ekgSide) runs exactly once, and does five things in one transaction:

1. It charges costOf(ekgSide) for the pool's EKG side, through the identical accounting as any ordinary mine: ninety percent of that cost returns to the caller after twenty four hours, and the kept tenth splits 70/20/10. The schedule advances because it was paid to. There is no premine.
2. It mints that EKG to itself and spends it into the EKG/WPLS pair through PulseX's own router, together with every PLS sent beyond the mining cost, which becomes the pool's PLS side.
3. It sends the LP tokens to the dead address. The founding liquidity is not timelocked or team-held — it is unownable. No key that exists can ever withdraw it.
4. It takes the pair out of the dividend split, before a single dividend exists, so the pool's growing EKG balance never absorbs payouts nobody can claim.
5. It sets opened, permanently. A second call reverts AlreadyOpen, from anyone, forever.

The caller can be anybody. Being first buys no advantage: the opener pays full halving one price for tokens that go into a pool they cannot withdraw from, and their name appears nowhere afterward. In practice the deployer calls it as the last step of launch day; in principle the protocol does not care.

The pool opens below the mining cost, deliberately. Day one, buying is cheaper than mining, the buyback spends into exactly that gap, and the mining cost above it only ever rises. The launch commit's own seven percent is already queued when the transaction ends — the first buyback can fire in the next block against a market that is guaranteed to exist, because the same transaction that made mining possible made the market.

03The Buyback: a buyer that never sells

EKG trades on PulseX like any other token. The protocol does not run the market, quote it or guarantee it. What it does is stand in that market as a buyer who never leaves.

Seven percent of every commit is pushed into the buy and burn contract in the same transaction as the mine that produced it. That contract has one exit: a call to executeBuyback, which swaps the queued PLS for EKG on PulseX and destroys every token it receives. There is no owner, no pause, no withdraw and no setter for the token or the pool. Anyone may fire it, and the caller is paid nothing for doing so, which is deliberate: a buyback that depends on one wallet remembering to call it is a buyback that stops the day that wallet stops caring.

The gate

A queue that has grown large against a thin pool should not go through in one transaction. It would spike the price on a candle nobody can trade against and hand most of the money to whoever was watching the mempool. So a single buy is capped at the largest size whose price impact lands on fifteen percent.

Buying with x against reserves (R, T) at fee f leaves the pool at

newPrice / oldPrice = (R + x)(R + fx) / R²

Setting that equal to 1 + g and solving the quadratic gives the cap in closed form:

x = R × ( √(10000·A² + 4·n·d·g_bps) − 100A ) / (200n),    A = n + d

At PulseX's fee of 0.29 percent and a fifteen percent gate that is 7.2486 percent of the PLS side of the pool. The contract computes it on chain with an integer square root, which truncates downwards, so the buy can only ever come in under the gate and never over it. Whatever the gate refuses stays queued.

The next buy can be larger than the last, because the buy before it added PLS to the pool it is buying from. Run against PulseX's own deployed bytecode, a queue far past the gate drained in fifty seven buys, fifty six of them capped, without one of them breaking fifteen percent.

What the gate does not do

It is a public buy on a public market. Somebody watching the mempool can trade in front of it. The gate bounds what that is worth on any single call and a one minute cooldown stops the queue being ground down inside a block, but neither makes it impossible, and every protocol that buys on an open market carries the same exposure. A time weighted price bound would narrow it further at the cost of a buyback that can stall when the price legitimately runs; that trade is open rather than made.

What this replaced

An earlier version of this protocol held the seven percent as a redemption pot with a published price and no market at all. It had a pleasing property — integer division meant a redemption could never lower the price, by arithmetic rather than by policy — and it was the wrong design, because a token nobody can trade is not a token. The adversarial findings against that pot are recorded in the test suite as removed rather than fixed, since the surface they attacked no longer exists.

04The schedule

369,000,000 tokens, ever, and this is Bitcoin's arithmetic with nothing added. Halving k holds CAP >> (k+1) tokens and prices every one of them at rate0 << k. Halving one holds half of everything, halving two a quarter, and the last sweeps whatever rounding left behind so the total is the cap to the wei. The price is flat inside a halving and doubles at the boundary, and because the boundary is a left shift of the opening rate, every one of the thirty six lands on a clean power of two with no drift.

tokens in halving k = CAP >> (k+1)    price = rate0 << k

There is no clock anywhere in this protocol. Nothing advances with time; a halving ends when its tokens are gone and not before. An order larger than the halving it lands in is not refused and not deferred: it takes what that halving has left at that halving's price, then keeps filling from the next at its price, inside the same transaction. Wanting more supply costs exponentially more, which is the only rationing here and the only kind nobody can wait out.

An earlier version cut each halving into 144 daily rounds with a hard clock between them, meaning to stop one funded wallet running the curve in a weekend. It was dropped. The clock could not stop that wallet, only make it wait, and in exchange it refused money from everybody else and turned the launch into a nine day sequence before a pool could even be opened.

Halving one is half the supply, which is deliberate and is the shape Bitcoin has. It also means the single most important number in this protocol is what halving one costs to clear, CAP / 2 × rate0 — which is what every other halving costs too. No clock and no per-transaction cap substitutes for setting that number correctly.

rate0 is a pure scale factor: it sets how much the protocol absorbs over its life and nothing about the shape. The test suite is run at two values three orders of magnitude apart, which is how that claim is checked rather than asserted.

What a halving costs

Halving k releases CAP >> (k+1) tokens at rate0 << k each, so the money needed to exhaust it is (CAP >> (k+1)) × (rate0 << k), and the shifts cancel. Every halving costs CAP / 2 × rate0 to clear. At the intended rate0 of 96.9 PLS that is 17,878,050,000 PLS, whatever the halving. The thirty sixth is the one exception and costs twice that, because it also sweeps whatever rounding left behind across the preceding thirty five; the remainder is 0.00537 of a token out of 369,000,000, and the whole curve is therefore thirty seven times the constant rather than thirty six.

cost to clear any halving = CAP / 2 × rate0    whole curve = 18.5 × CAP × rate0

Two consequences follow, and both are the point of writing the schedule this way. The first is that the price is exponential in money spent: n times the constant buys n doublings, so a hundredfold difference in money in is a 2¹⁰⁰ difference in price out. The second is that no halving is ever harder to finish than the first one was, which is what stops the curve stalling before the cap is reached.

The site multiplies these PLS figures by the price of PLS read from the three deepest PulseX dollar pools, taking the median of the three so that no single pool can set the number. That is presentation, not protocol: nothing in any contract reads a price feed, and nothing in any contract can.

05The price has two rules

A token costs what the schedule says it costs. There used to be a second rule — a guard that refused to mint below the price at which the seven percent covered what the redemption pot already owed per token — and it went with the pot. With nothing held in reserve there is nothing a mint can dilute and nothing for a guard to protect.

What is left is flat inside a halving and doubles at every boundary, and no function in any of the three contracts lowers it.

rate = scheduleRate

The market price is a different thing entirely and nobody sets it. It is whatever people pay on PulseX. The protocol's only relationship to it is as a buyer, and the interesting condition is when the market sits below what mining costs: then buying is the cheaper way in, and the buy and burn has somewhere to push. The pool is opened deliberately below cycle one true cost for exactly that reason.

06The Pulse: holders are paid for holding

Two percent of every commit goes to holders in PLS, the chain's own coin. No lock, no registration, no staking of any kind: holding the token is the entire qualification. Dividends accrue per eligible token and are claimed when you want them. The protocol's own contracts are excluded, so nothing accrues to an address with no hands.

Mining gets dearer as the schedule advances, and the schedule advances only when somebody mines. The true cost doubles at every halving while the market price is whatever the market says it is, so there is always a point where buying EKG on PulseX is cheaper than mining it — which is the whole reason a pool exists rather than a redemption window. Dividends are heaviest while the supply is small and thin out as it grows.

07The Shield: payments without a trace

A balance on a public chain is a public fact about a person, and so is every payment they have ever made or received. Zcash solved that in 2016 and the design has held up: value lives in notes that are never published, a commitment to each note goes into an append only Merkle tree, and spending one publishes a nullifier — a tag derived from the note and the owner's key that proves the note is being retired without revealing which note it was. Double spending is prevented by a set membership check on nullifiers. The link between a nullifier and the commitment it retires exists only inside a zero knowledge proof.

That construction ports to an EVM contract without changes to anything around it. EKG Shield is a separate contract that holds EKG and nothing else touches the core. The three audited contracts do not change, and a bug in the Shield cannot reach them.

The design

• One circuit, three operations. A transaction takes two input notes and produces two output notes, with a signed public amount. Positive means value entering the pool, zero means a private transfer inside it, negative means value leaving. Shield, send and unshield are the same proof with a different sign.
• Groth16 over BN254, not Halo 2. Zcash uses Halo 2 with an inner product argument, which has no EVM precompile and costs millions of gas to verify on chain. BN254 pairing is a precompile, so a verification is a few hundred thousand gas. The trade is a trusted setup per circuit, which is an honest cost and a solved process.
• Poseidon for the commitment, the nullifier and the Merkle path, because it is cheap inside the circuit.
• A rolling window of recent roots, so a proof built a few blocks ago still verifies.
• Viewing keys. You can hand somebody the ability to read your entire history without handing them the ability to spend a single note.
• A turnstile. The contract tracks how much EKG has ever entered the pool and refuses to let more than that leave.

What shielding costs you

EKG pays dividends in PLS to whoever holds the token. Tokens inside the Shield are held by the pool contract, so the dividends accrue to the pool rather than to the people whose notes are inside it. Splitting them back out privately means putting a per share accumulator into the circuit, which roughly doubles the circuit surface — the exact surface where Zcash's counterfeiting bug lived.

So the Shield does not try. Shielded tokens earn nothing individually. And here the design ran into a fact about the core that is worth stating plainly, because it is the opposite of what a reasonable person would guess.

EKG's exclusion call, setExcluded, can only be made by the Mine, and the Mine's only caller of it is wire() — which takes no arguments, runs once, and excludes exactly two addresses: the buy and burn and the Mine itself. There is no parameter. There is no second call. The Shield cannot be excluded from the Pulse by anyone, ever. It is an ordinary holder and it accrues PLS in proportion to the tokens it holds, whether that is convenient or not.

The Shield's answer is a function called sweepDividends. It takes no arguments, anybody may call it, and everything it collects goes straight back into EKG's own distributor to be paid out to every eligible holder by balance. There is no recipient parameter and no address in it that a caller controls; the caller gets nothing but the gas bill. It also cleans up PLS that arrived by any other route, including a contract destroying itself into the address.

The pool keeps back its own pro rata slice, because it is an eligible holder too and there is no way to make it not one. Calling the sweep repeatedly drives that retained amount geometrically towards nothing. The net effect is the honest one: shielding donates your dividend stream to everyone still holding in public. Nobody can capture it, including us, and no decision about the core has to be settled before the Shield can exist.

What it will never have

No fee, to anyone. No owner, no admin key, no proxy, no upgrade path. No relayer operated by us. These are not aesthetics. In Van Loon the Fifth Circuit held that immutable contracts are not property that can be sanctioned, and Treasury delisted Tornado Cash in March 2025 while expressly reserving its position on mutable ones. Every mixer prosecution that has resulted in a conviction has led with fees collected and with conduct: a developer of Tornado Cash was convicted in 2025 of conspiring to operate an unlicensed money transmitting business, and the Samourai Wallet founders were sentenced to five and four years in November 2025, with roughly six million dollars in fees front and centre. An immutable, unmonetised, non custodial contract is a materially different object, and that is the only kind worth building.

08What the protocol cannot do

• No owner, no pause, no setters, no proxy, no upgrade path. Every address is fixed at deployment.
• No open burn. Only the buy and burn may burn, and only what it has just bought.
• No transfer tax. The token behaves like a token in every router and integration.
• Nothing can spend the PLS set aside for miners. The only function that moves it is the miner's own claim.
• Nobody can be excluded from the Pulse. The exclusion call takes no argument, runs once, and is one way.
• Operations is pull, never push, so a recipient that refuses PLS can never block somebody else's commit.
• No mining before the market. Every mine reverts until the launch transaction has created and funded the pool.
• No pulling the founding liquidity. The launch burns its LP tokens; no key that exists can withdraw that pool.
• No second launch. openMine() is one way and one time, for everyone including the deployer.

09Adversarial review

An immutable contract gets exactly one draft. There is no patch, no pause and no owner to call, so the only place a mistake can be found is before deployment. Six rounds of adversarial review ran over these contracts with that in mind, each one starting from the assumption that the previous round had missed something.

Between them they found four ways to stop the protocol permanently, one of which was opened by the fix before it. That is the point of the exercise, and the number is reported here rather than buried because a design that has never been attacked has not been shown to be anything. All four are closed, and each one has a regression test written to fail loudly if the fix is ever removed. What follows is what they were.

10Not in this version

Locking, flatline penalties and the conviction score are designed and deliberately not built. They add a locking surface and a penalty flow on top of the core loop, and the core loop is what goes through a testnet and an external audit first. Mine, hold, get paid, trade. A smaller surface to audit and a shorter path to something real on chain.

11Status

Core contracts

3, immutable

Tests passing

104

Invariant checks

2,499

Adversarial reviews

6

Testnet

live, v4

Shield

on testnet

External audit

not yet

Mainnet

gated on the audit

The test suite passes at two entry points three orders of magnitude apart, which is how the claim that the opening price is only a scale factor got checked rather than asserted. A hundred simulated days with a thousand wallets, run against PulseX’s own bytecode from launch through a full unwind, executes 2,499 invariant checks after every transaction without one breaking.

This paper describes software, not an investment. It makes no claim about what the token will be worth, and the backing is a property of the contract's arithmetic, not a prediction about any market. Testnet figures are not prices.