dust
1 1 SAME COUNT GRAINS COLLECTED 0 1 2 3 4 5 6 DUSTPAN
The panA speck and a boulder are each one

02  /  The rule

Enforced by a test, not asserted in a README.

A one-line require(balanceOf(msg.sender) >= fee) — the kind of change a reviewer waves through as a friendlier error — turns the suite red.

Status

Nothing is deployed. No factory, vault or ledger address exists on any chain, no transaction has been broadcast, and the repository carries no git remote. ./submission/check asserts all three.

03  /  Enforced, not asserted

A test reads the contract’s own source and counts the balance reads.

Every call to the token’s balance function in DustLedger.sol has to be against the burn address. balanceOf(msg.sender) appears zero times.

DUST.balanceOf(0x…dEaD)the one permitted read
require(DUST.balanceOf(msg.sender) >= fee, "…")turns the suite red

The second line is the kind of change a reviewer waves through as a friendlier error message. It was added to a copy of the source and watched to fail, and so were twenty-six other guards. What was tested, and what is not proven.

04  /  What a press costs

A flat fee of the token, burned.

The same number for a whale and for a newcomer, and it would be fixed at launch. Nothing in the ledger as written could move it afterwards: its whole state-writing ABI is initialize and sweep, the source holds exactly one assignment to fee and it sits inside initialize, and there is no inline assembly to write the slot behind either. A raisable fee would be a lever over everyone already enrolled; a lowerable one would be a lever over the equilibrium headcount.

initialize, sweepthe whole state-writing ABI — a setter under any name fails this
fee = …  ×1, inside initializea fee that creeps inside sweep fails this
inline assembly  ×0an sstore to the slot fails this

All three breaks were introduced on a copy of the source and watched to fail. The one reach that remains is stated rather than netted out: the Guardian owns the beacons, so an upgrade could install an implementation that does carry a setter — the same reach that lets the Guardian rescue funds.

This is Sybil pricing, not Sybil resistance.

A hundred addresses can press, and we do not pretend one address is one person. Each of them burns a fee — and because the token is taxed on transfer, the burn itself would pay tax into the pot that pays everyone else. The farmer is the buyer of last resort for the people they are diluting.

Sybil pricing  /  one farmer, a hundred addresses

A period holding 1.0000 BNB, an entry fee worth 0.0500 BNB, and twelve addresses already pressing — the headcount at which the wage is exactly the fee. A farmer adds a hundred more. Both lanes run from zero to what the hundred presses cost. Schematic: the pot and the fee are chosen; the division is the contract’s, 6000 bps of the pot over 112 addresses.

  1. What the hundred addresses cost to press — one flat fee each, burned

    5.0000

  2. What the hundred addresses collect — a hundred wages of 0.005357

    0.5357

The farmer is not stopped. The farmer is charged: they spend nine times what they take, because the wage they are diluting is the wage they are collecting. The twelve who were already there fall from 0.050000 each to 0.005357 — the dilution is real, and it is priced rather than forbidden. And the hundred fees are burned through a taxed token, so part of what the farmer spent arrives in the same pot the other twelve are paid from.

totalBurned records what actually landed at the burn address, not what was charged. Where the token taxes that transfer the two differ by exactly its tax rate, and recording the requested amount would overstate the burn every time it does. The gap between charged and landed, drawn.