Some Bitcoin outputs rely on cryptographic assumptions that may not hold forever.
1.72M BTC sit in P2PK addresses with public keys exposed on-chain since creation.
If ECDSA degrades under quantum computing, those keys become insecure immediately.
Satoshi's Donation Protocol restricts spendability of these outputs
once their security assumptions can no longer be guaranteed. Invalid spend paths
are removed. Remaining value integrates into block rewards.
If no cryptographic break occurs, no additional value enters circulation.
The 21M cap holds. Quantum-safe holders are never touched. Key rotation preserves ownership.
1. Lost coins. 3–4M BTC are gone. Keys destroyed, holders dead, seeds forgotten. The real circulating supply is closer to 17M than 21M, and it shrinks every year.
2. Cryptographic assumption degradation. 1,720,270 BTC sit in P2PK addresses with public keys exposed on-chain since creation. These predate BIP-32 (2012) and BIP-39 (2013). If a CRQC becomes operational (credible but uncertain; estimates range 2030–2040+), Shor's algorithm can derive private keys directly from the exposed public key. There is no seed phrase. The private key is the root.
3. Security budget. The block reward halves every ~4 years. By halving 6 (~2032), it drops below 1 BTC for the first time. Satoshi wrote: "In a few decades when the reward gets too small, the transaction fee will become the main compensation for nodes." That decade is approaching. Whether fees alone can secure a multi-trillion dollar network is an open question.
| Proposal | Mechanism | Problem |
|---|---|---|
| BIP-361 (2026) | Freeze quantum-vulnerable coins, 3-phase sunset | freezes but adds nothing to security budget |
| PoAR — Proof of Activity Reclamation (2025) | Restrict spendability of ALL UTXOs after 20 years of inactivity | targets all coins regardless of crypto status |
| Bitcoin Issue #31941 (2025) | Expire ALL UTXOs after 16 years | targets all coins, no quantum justification |
| Freicoin (2012) | 5% annual demurrage on ALL coins | penalizes all holders, separate chain |
They all failed for the same reasons:
SDP does three things that no prior proposal did at the same time:
Note on parameters. The 1 BTC subsidy threshold and the block ~1,035,000 cutoff are proposed starting values. Both are BIP-level parameters subject to refinement through the community process; this document fixes them only to make the mechanism concretely analyzable.
If your public key is not on-chain, you are not affected. Hold forever.
The initial scope targets only P2PK addresses — the cleanest case. Public key is embedded in the scriptPubKey at creation. No chain analysis required. Deterministic detection. This covers the vast majority of quantum-exposed value (~1.72M BTC).
Reused P2PKH addresses (where the public key was revealed in a prior spend) are a secondary target. Detection requires tracking spend history across the chain, which is more complex. This phase should be subject to separate community debate and consensus.
| Address Type | Public Key Exposed? | Quantum Risk | Subject to Donation? |
|---|---|---|---|
| P2PK (Pay-to-Public-Key) | Yes — at creation | critical | Yes (Phase 1) |
| P2PKH (reused, key revealed) | Yes — after first spend | critical | Phase 2 (future debate) |
| P2PKH (never spent) | No — behind HASH160 | safe | No |
| P2SH / P2WSH | No — behind hash | safe | No |
| P2WPKH (SegWit v0) | No — behind hash | safe | No |
| P2TR (Taproot) | Internal key in witness, but only after spend | safe* | No |
| Future PQC types | No | safe | No |
*Taproot key-path spends reveal the internal public key in the witness, but only after the UTXO is spent (funds already moved). Unspent Taproot outputs expose only a 32-byte x-coordinate, not a full public key. This is architecturally different from P2PK, where the full public key is in the scriptPubKey of unspent outputs.
Nothing happens until the block reward drops below 1 BTC. That's halving 6, block 1,260,000, around 2032. Before that, the network doesn't need it.
| Halving | Block Height | ~Year | Block Reward | Donation Active? |
|---|---|---|---|---|
| 0 (genesis) | 0 | 2009 | 50 BTC | no |
| 1 | 210,000 | 2012 | 25 BTC | no |
| 2 | 420,000 | 2016 | 12.5 BTC | no |
| 3 | 630,000 | 2020 | 6.25 BTC | no |
| 4 (current) | 840,000 | 2024 | 3.125 BTC | no |
| 5 | 1,050,000 | 2028 | 1.5625 BTC | no |
| 6 | 1,260,000 | ~2032 | 0.78125 BTC | trigger |
| 7 | 1,470,000 | ~2036 | 0.390625 BTC | active |
| 8 | 1,680,000 | ~2040 | 0.1953125 BTC | active |
| 33+ | 6,930,000 | ~2141 | 0 BTC | perpetual |
The donation fills the gap between the halving reward and a decaying cap. Like Bitcoin's block subsidy, the donation halves every 210,000 blocks. The pool never fully depletes.
| Era | Subsidy | Donation Cap | Total Reward | Pool Used/Era | Pool Remaining |
|---|---|---|---|---|---|
| Halving 6 | 0.78125 | 0.21875 | 1.00000 | ~45,938 | ~1,674,332 (97.3%) |
| Halving 7 | 0.39063 | 0.10938 | 0.50000 | ~22,969 | ~1,651,364 (96.0%) |
| Halving 8 | 0.19531 | 0.05469 | 0.25000 | ~11,484 | ~1,639,879 (95.3%) |
| Halving 9 | 0.09766 | 0.02734 | 0.12500 | ~5,742 | ~1,634,137 (95.0%) |
| Halving 10 | 0.04883 | 0.01367 | 0.06250 | ~2,871 | ~1,631,266 (94.8%) |
| Halving 11 | 0.02441 | 0.00684 | 0.03125 | ~1,436 | ~1,629,831 (94.7%) |
| Halving 12 | 0.01221 | 0.00342 | 0.01562 | ~718 | ~1,629,113 (94.7%) |
| Halving 13, 14, 15... | halves | halves | halves | halves | converges → 94.7% |
| Geometric sum (infinite — donation never stops, only shrinks) | ~91,875 BTC | 94.7% untouched | |||
| Holder | Address | What Happens | Cost |
|---|---|---|---|
| HODLer (P2PKH/Taproot/P2SH) | Quantum-safe | Not impacted. Hold forever. | zero |
| Active user | Any | No change | zero |
| P2PK holder (alive) | Quantum-exposed | Key rotation to safe address before cutoff | ~$1-5 |
| Lost keys (P2PK) | Quantum-exposed | No longer spendable; value integrates into block rewards | returned to network |
| Early P2PK outputs (incl. Patoshi pattern) | Quantum-exposed | Same rules as all P2PK; key rotation preserves ownership | same condition |
| Quantum attacker | P2PK targets | Exposure neutralized — coins already in donation pool or rotated | preempted |
Any living holder can opt out with one transaction. Only coins whose owners are gone — or who choose not to rotate keys despite years of advance notice — enter the pool.
~1.1M of the 1.72M BTC in P2PK are attributed to the Patoshi mining pattern. SDP does not target these outputs specifically. It targets a cryptographic condition — exposed public key in scriptPubKey — shared by all 45,257 P2PK UTXOs in the current set (Mempool.space UTXO report, block 892,385). The rule is identical for all.
If the keyholder exists, one transaction to a quantum-safe address preserves ownership. If keys are lost, those outputs face the same ECDSA degradation as every other P2PK UTXO. Without SDP, they are exploitable by any adversary with a CRQC. With SDP, invalid spend paths are removed and remaining value follows block reward rules.
The perception risk is real: if this is seen as targeting specific outputs rather than a cryptographic condition, the proposal fails politically regardless of technical merit. This document acknowledges that risk.
| Scenario | Effect | Mitigation |
|---|---|---|
| Mass key rotation before cutoff | Donation pool shrinks. Less BTC available for mining rewards. | This is the desired outcome. If all P2PK holders rotate keys, quantum vulnerability is eliminated and SDP's donation pool is empty. Miners gain nothing from the pool but the network gains quantum resilience. The hard fork still has value: it establishes the consensus rule that P2PK UTXOs below the cutoff are unspendable, preventing future quantum exploitation even if the pool is exhausted. |
| Mempool congestion near cutoff | Key-rotation transactions compete for block space. Fees spike. | The cutoff is years away from activation. Holders have from announcement until ~2032 (cutoff + 4 years before donation begins). A last-minute rush indicates poor planning, not a protocol flaw. |
| Miners game the donation pool | Miners could theoretically prefer blocks that maximize donation payouts. | The donation cap is deterministic per block (INITIAL_GAP >> halvings). Miners cannot influence the cap. Pool balance / remaining blocks is also deterministic. No MEV-style extraction is possible. |
| Strategic inactivity | A holder deliberately does not rotate, hoping the proposal fails or is reversed. | Their choice. The opt-out remains available until the cutoff. After the cutoff, the cryptographic exposure remains regardless of SDP. Inaction is not a strategy against quantum. |
| Whale coordination before cutoff | Large P2PK holders coordinate to rotate simultaneously, draining the pool and claiming SDP is unnecessary. | This proves the mechanism works as designed. If all P2PK holders rotate, quantum risk is eliminated. The pool is empty because the problem is solved. The consensus rule remains: P2PK UTXOs below cutoff are unspendable regardless of pool size. |
P2PK coins have their public key on-chain since creation. If ECDSA assumptions degrade under quantum computing, Shor's algorithm can reverse the elliptic curve multiplication to derive the private key. These coins predate seed phrases. There is no derivation chain. The private key is the root. An attacker who derives it is mathematically indistinguishable from the owner.
This proposal does not assume a specific quantum timeline. It defines a deterministic response to the structural vulnerability of exposed public keys. The question is: compromised by an adversary, or recycled into the security budget?
A reasonable objection: if quantum is uncertain, why not trigger SDP only when a CRQC is demonstrated? Because by that point it is too late. Once a CRQC exists, every P2PK private key is derivable immediately. There is no migration window after the fact. The NIST deprecation schedule (ECC deprecated 2030, disallowed 2035) reflects the same logic: you migrate before the threat materializes, not after. SDP's fixed cutoff provides a known, predictable migration deadline. If quantum never arrives, the donation pool sits unused and no harm is done. The mechanism is a contingency, not a prediction.
Satoshi put a message in the genesis block: "The Times 03/Jan/2009 Chancellor on brink of second bailout for banks." The coinbase scriptSig can carry meaning. SDP uses it to record every donation:
Every donation traceable. Every block carries the message.
The coinbase scriptSig already supports arbitrary data (up to 100 bytes) after the BIP-34 block height. Miners use it for pool identification. A donation tag fits the same space.
If this contradicts what Satoshi wrote, it doesn't belong in Bitcoin. Here is what he said, and how SDP aligns:
| Satoshi Quote | Source | Alignment |
|---|---|---|
| "Lost coins only make everyone else's coins worth slightly more. Think of it as a donation to everyone." | BitcoinTalk, June 2010 | 100% — makes the donation literal |
| "Once a predetermined number of coins have entered circulation, the incentive can transition entirely to transaction fees and be completely inflation free." | Whitepaper, Section 6 | 100% — no new coins, still inflation-free |
| "In a few decades when the reward gets too small, the transaction fee will become the main compensation for nodes." | BitcoinTalk, Feb 2010 | 95% — fees remain primary; donation supplements |
| "Any needed rules and incentives can be enforced with this consensus mechanism." | Whitepaper, Conclusion | 100% — new rule, same consensus mechanism |
| "What is needed is an electronic payment system based on cryptographic proof instead of trust." | Whitepaper, Section 1 | 100% — no trusted party decides; protocol enforces |
| "...since there is no central authority to issue them." | Whitepaper, Section 6 | 100% — no central authority; protocol enforces |
| "The nature of Bitcoin is such that once version 0.1 was released, the core design was set in stone for the rest of its lifetime." | BitcoinTalk, June 2010 | 80% — core design (21M, PoW, P2P) untouched; specific rules evolve. Satoshi himself added features after v0.1. |
Satoshi expected fees to handle it: "I'm sure that in 20 years there will either be very large transaction volume or no volume." He also said the core design was "set in stone."
But he did not anticipate quantum computers threatening 1.72M BTC. That problem didn't exist when he wrote the whitepaper. His own conclusion — "Any needed rules and incentives can be enforced with this consensus mechanism" — leaves room for new rules within the same framework.
He also modified Bitcoin after v0.1: the 1MB block size limit, OP_NOP codes, the alert system. "Set in stone" meant the core design — 21M cap, proof-of-work, no trusted third party. SDP preserves all of these.
Ownership means key possession, enforced by protocol, not authority. No cypherpunk has ever advocated seizing dormant digital property. Fair enough. Here's how SDP fits:
| Cypherpunk Principle | Source | Alignment |
|---|---|---|
| "Cryptographic proof instead of trust" | Satoshi, Hughes, Szabo | preserved — protocol-enforced, no human decision |
| Ownership = key possession | Szabo, "Secure Property Titles" | preserved — quantum-safe key holders unaffected forever |
| "No collusion of servers can forge Alice's signature" | Szabo | preserved — no signatures forged; restricted outputs are unspendable |
| "We must defend our own privacy... with electronic money" | Hughes, Cypherpunk Manifesto | preserved — mechanism is transparent, opt-out is free |
| Self-sovereignty / individual rights paramount | All cypherpunk literature | nuanced — see below |
"You're restricting spendability based on inactivity."
1. Quantum-safe holders are not touched. P2PKH, P2SH, Taproot, PQC — hold forever.
2. For quantum-exposed coins, the public key is on-chain. If ECDSA degrades, the private key is derivable. The choice is "compromised by adversary" or "recycled to miners." Spendability depends on cryptographic security assumptions.
3. The opt-out exists. One transaction to a safe address. Years of advance notice. This is not revocation of ownership — it is a key-rotation deadline.
4. Bitcoin already restricts spendability based on consensus rules. OP_RETURN outputs are provably unspendable. Invalid scripts are unspendable. Pre-SegWit anyone-can-spend outputs became restricted after activation. SDP adds one more condition: P2PK outputs with exposed keys below the cutoff height become unspendable after activation, unless rotated first. This is a consensus rule change, not property seizure.
SDP modifies spend validity rules. After activation, P2PK UTXOs created before the cutoff height are no longer valid inputs to a transaction. This is a consensus-level change that requires broad agreement among developers, miners, node operators, and economic stakeholders.
The activation timeline spans years, not months. BIP-9 style miner signaling with a 95% threshold governs lock-in. If the threshold is not met, the rule does not activate.
BIP-361 already solves the quantum problem. Freezing quantum-exposed coins prevents exploitation. That part is done. SDP does not dispute this.
BIP-361 is the minimal, conservative rule change and, given Bitcoin's deserved conservatism around consensus, it is the more likely path to activation. SDP is the more ambitious proposal: it accepts greater controversy in exchange for addressing the security budget alongside the quantum defense.
SDP asks: once coins are frozen because their cryptographic protection has degraded, what should happen to the value? It can sit frozen indefinitely, contributing nothing. Or it can integrate into the block reward structure that secures every other coin on the network. Freezing solves quantum. SDP solves quantum and addresses the security budget. That additional step is the one that requires justification, and the one this proposal exists to debate.
Bitcoin Core already stores creation height (nHeight) for every UTXO. Script type is deterministic from the scriptPubKey. The pieces are there.
The donation pool is not a separate balance or data structure. It is derived from the
UTXO set at any given block height: the sum of all UTXOs where
IsP2PK(scriptPubKey) && nHeight < DORMANCY_CUTOFF.
This is deterministic and reorg-safe — recomputable from chainstate at any point.
No additional persistent state is required beyond what Bitcoin Core already maintains.
The spending restriction (REJECT_DORMANT_QC_EXPOSED) applies only to blocks after an activation height, not retroactively. During IBD and reorgs, blocks before activation are validated under prior rules. This is the same activation model used by SegWit, Taproot, and other soft/hard fork deployments.
| Component | What Changes | Complexity | ~Lines |
|---|---|---|---|
| IsQuantumExposed() check | Script type detection for P2PK / reused P2PKH | low | 50–100 |
| Dormancy validation | Height comparison in consensus validation | low | 50–100 |
| GetBlockReward() modification | GetBlockSubsidy() + donation gap filler | moderate | 200–300 |
| Donation Pool | New data structure tracking expired QC-exposed BTC | moderate | 500–800 |
| Coinbase donation message | Structured tag in coinbase scriptSig | low | 50–100 |
| Wallet alerts & migration | Track QC-exposed UTXO ages, warn users | moderate | 300–500 |
| RPC + test coverage | New commands, unit + integration tests | required | 600–1,200 |
| Total | ~1,800–3,100 |
Comparable in code volume to Taproot (~3,000–5,000 lines). Simpler cryptographically — no new signature schemes, mostly integer comparisons. Requires a hard fork. UTXO validity rules change. This is fundamentally different from Taproot's deployment (soft fork). The comparison is to implementation complexity only, not deployment difficulty. A hard fork requires near-universal node upgrade — a much higher coordination bar.
| Claim | Source | Status |
|---|---|---|
| 3–4M BTC estimated permanently lost | Chainalysis, Unchained | verified |
| 1,720,270 BTC in P2PK (45,257 UTXOs) | Mempool.space UTXO report, block 892,385 | verified |
| ~1.1M BTC attributed to Satoshi (Patoshi pattern) | Sergio Demian Lerner, 2013–2019 | verified |
| Block reward drops below 1 BTC at halving 6 (block 1,260,000) | GetBlockSubsidy() source code: 50*COIN >> 6 = 78,125,000 sat | verified |
| P2PK exposes public key at UTXO creation | Bitcoin script specification | verified |
| P2PK predates BIP-32 (2012) and BIP-39 (2013) | BIP publication dates | verified |
| CRQC estimates: 2030–2040+ (wide range, no consensus) | Google: 10% by 2030, roadmap ~2029. NIST: deprecate ECC by 2030, disallow by 2035. Experts: 50%+ by 2030–2035. Skeptics: 2040+. secp256k1 needs ~500K physical qubits (Google 2025 paper). | verified |
| nHeight stored in chainstate for every UTXO | Bitcoin Core source (struct Coin) | verified |
| Coinbase scriptSig supports arbitrary data after BIP-34 height | BIP-34, Bitcoin Core consensus rules | verified |
| 21M cap preserved (no new coins created) | Mathematical property of the design | verified |
| Requires hard fork | Changes UTXO validity rules | verified |
| All Satoshi quotes used in this document | Satoshi Nakamoto Institute archive | verified |
| Similar proposals (PoAR, Issue #31941) were criticized/rejected | bitcoindev mailing list, GitHub | verified |
| Claim | Calculation | Status |
|---|---|---|
| ~11,497 BTC/year donated at halving 6 | 0.21875 × 144 × 365 | math correct |
| 50+ years of runway at initial rate | 1,720,000 ÷ 11,497 | math correct, pool size estimated |
| ~17M effective circulating supply | 21M − 3–4M lost | math correct, "lost" estimated |
| Claim | Honest Assessment |
|---|---|
| "Only abandoned coins are affected" | assumption — Edge cases: imprisoned, persecuted, incapacitated P2PK holders who cannot migrate. |
| "Quantum problem solved by timing" | depends — True only if CRQC arrives after donation trigger (~2032). Estimates range widely (2030–2040+). If CRQC arrives before trigger, exposed keys are compromised before SDP activates. SDP is a precaution, not a guarantee. |
| "1 BTC floor is the right number" | parameter choice — Why 1 BTC and not 0.5 or 2? Requires economic modeling that doesn't exist yet. |
| "Block ~1,035,000 is the right cutoff" | governance decision — The cutoff height is not derivable from cryptography or first principles. It is a policy parameter — a human decision about where to draw the line. This is the point where SDP crosses from cryptographic mechanism into governance. Any specific height is a tradeoff between migration window and activation timeline. The community must choose it, and that choice is inherently political. |
| "Self-selecting mechanism" | assumption — Assumes all living P2PK holders will be aware of and able to respond to the migration requirement. |
| "Hard fork is achievable" | unproven — Bitcoin has never executed a contentious hard fork. This is the biggest barrier. |
Fair objections deserve honest answers.
| Objection | Defense |
|---|---|
| "This is confiscation." | Ownership is not revoked. Spendability is conditional on cryptographic security assumptions. P2PK keys are exposed on-chain — if ECDSA degrades, the private key is derivable by anyone. SDP provides a multi-year key-rotation window. One transaction to a safe address preserves ownership forever. |
| "The core design was set in stone. You can't change consensus rules." | Satoshi changed consensus rules himself. Block 74,638 created 184 billion BTC from an overflow bug. He published v0.3.10 within 5 hours and reorged the chain. He added the 1MB limit, OP_NOP codes, the alert system — all after v0.1. "Set in stone" meant 21M, PoW, P2P. SDP preserves all of them. |
| "Bitcoin has never done a contentious hard fork." | True. This is the biggest barrier. Bitcoin has forked before (value overflow, 2010), but never contentiously. SDP does not force activation. If miners reject it, it doesn't happen. "Any needed rules and incentives can be enforced with this consensus mechanism." |
| "This sets a dangerous precedent." | The condition is cryptographically specific: public key on-chain or not. Binary, deterministic, verifiable by any node. SDP Phase 1 targets only P2PK — a fixed, shrinking set. Extending to quantum-safe types would require an entirely different technical justification and separate consensus. The mechanism is exhausted once P2PK is addressed. |
| "What about holders who can't migrate?" | Valid concern. But these holders face the same cryptographic degradation with or without SDP. Their public keys are exposed. Without SDP, those keys are exploitable by any adversary with a CRQC. Pre-signed time-locked migrations and multisig estate plans can mitigate this. |
| "The 21M cap is sacred. Don't touch the supply." |
Zero new coins are created. MAX_MONEY stays at 2,100,000,000,000,000 satoshis.
Existing coins move, nothing is minted. Satoshi:
"Once a predetermined number of coins have entered circulation, the incentive
can transition entirely to transaction fees and be completely inflation free."
Same coins, different hands.
|
| "Miners shouldn't get free coins." | Miners provide the proof-of-work security budget. Satoshi designed block rewards for this: "The incentive may help encourage nodes to stay honest." The alternative is that coins with degraded cryptographic protection are exploited by the first adversary with a CRQC. |
| "Transaction fees will be sufficient. No supplemental reward needed." | Satoshi expected this. SDP doesn't contradict it — fees stay primary. The donation is a supplement that halves geometrically (5.3% of pool ever used). If fees are sufficient, the donation is negligible. If they're not, it's a safety net. |
| "Only 5.3% of the pool is used. What's the point?" | 5.3% = ~91,875 BTC spread across all future eras. Small per block, but perpetual. The signal to miners matters as much as the amount. And the geometric decay mirrors Bitcoin's own emission schedule. |
| "If Satoshi returns?" | Key rotation: one transaction to a quantum-safe address. Coins preserved forever. If keys are lost, the exposed public keys face the same ECDSA degradation as any other P2PK. The opt-out is available to any keyholder. |
The overflow fix proves three things: rules can change when the threat is real, Satoshi initiated such changes himself, and the market rewarded it. Different threat (quantum, not overflow). Same principle.
There's no rush. The donation doesn't activate until the subsidy drops below 1 BTC, around 2032. That gives roughly six years to discuss, review, implement, test, and let miners decide. The timeline below is a reasonable sequence, not a promise.
Publish the proposal. Post it to the bitcoindev mailing list and let people pick it apart. If the idea has a fatal flaw, this is where it dies. That's fine. Better to find out now.
If the concept survives discussion, write a formal BIP. The consensus rules need independent security review. The donation logic needs to be verified, not just tested. Miners and pool operators should weigh in on the game theory. This takes time. It should.
Write the code. Open a Bitcoin Core pull request. The changes are small — a few hundred lines touching validation, block reward calculation, and coinbase serialization. The test suite matters more than the implementation itself.
Run it on testnet and signet. Simulate multiple halving eras. Make sure the donation halving decays correctly, the pool accounting holds up, and nothing breaks at the edges. Let it run long enough that people can see it working, or see it fail.
This is where it either happens or doesn't. Miners signal support through version bits, same mechanism as SegWit. If 95% of blocks in a retarget period signal yes, it locks in. If they don't, it doesn't. Nobody can force this. That's the point.
The subsidy drops to 0.78125 BTC. The gap appears. The first donation fills it — 0.21875 BTC from the pool to the miner. Recorded in the coinbase, like the genesis message. From here, it halves every 210,000 blocks and never stops.
Dates are approximate. Nothing moves forward without consensus. If it takes longer, it takes longer.
SDP requires a hard fork. This should not be hidden or minimized.
Bitcoin has never executed a contentious hard fork. The value overflow fix (2010) was a consensus-breaking change, but it was uncontroversial — the bug was unambiguously harmful. SDP's justification (preempting quantum exposure) is less clear-cut. Reasonable people disagree on quantum timelines, on whether fees alone will suffice, and on whether any UTXO-touching rule change is acceptable.
For this reason, SDP requires:
• Broad agreement among developers, miners, node operators, and economic stakeholders
• A long activation horizon (years, not months)
• BIP-9 style miner signaling with a high threshold (95%)
• Possible phased deployment: P2PK first, with separate consensus for any extension
• A community-defined expiry: if the BIP does not activate within N retarget periods, it expires
If the community rejects SDP, it does not activate. That is the system working as designed. This proposal is a starting point for discussion, not a predetermined outcome.
Outputs secured under degraded cryptographic assumptions face two futures: exploited by an adversary, or frozen indefinitely.
SDP defines a third: remaining value integrates into the security budget that protects everyone.
If no cryptographic break occurs, no additional value enters circulation. Triggered when needed. Scoped to P2PK. Key rotation preserves ownership. Recorded in every block.
"Think of it as a donation to everyone."
— Satoshi Nakamoto
Quantum-safe holders are never touched. The 21M cap is never violated. Spendability becomes conditional on cryptographic integrity — nothing more.