O-Coin (OCN) is a hybrid proof-of-work / proof-of-stake blockchain. It has no company behind it, no allocation held back for a team, and no genesis supply left in anyone's hands — the 5,000,000,000 OCN minted at block 0 was permanently burned to a provably keyless address on 19 July 2026. Every coin that has existed since was produced by mining or staking under rules anyone can run. This page is the specification and the roadmap. Everything in it is checkable against the live chain, and where a claim can be checked, the link to check it is included.
1 · In plain English
What O-Coin is
A blockchain is a shared list of transactions that no single participant controls. O-Coin is one of those, written from scratch in Python, running right now across independent nodes that check each other's work. It keeps a running balance for every address, and it agrees on new entries roughly every fifteen seconds.
It was built in the spirit of Dogecoin's early years — fast, cheap, casual transfers, a tipping culture, and a chain that is interesting to read rather than impressive to market. It is a real chain doing real cryptography, and it is also a hobby project by one person. Both of those are true and neither is hidden.
The premine, and why it was burned
The very first block created 5 billion OCN and put them in a single address. That is a premine, and it is the mechanism behind most of what people mean when they say a coin is a scam: whoever holds that supply can sell it into whatever demand later shows up, and everyone who bought is the other side of that sale.
Those coins were sent to an address that has no private key and cannot have one. O-Coin addresses are normally the SHA-256 hash of a public key. The burn address is instead the SHA-256 hash of a fixed public string, OCN:BURN:GENESIS-PREMINE. To spend from it you would have to find a public key whose hash collides with that value, which is not something anyone can do. You can reproduce the address yourself in two lines of Python, and you can watch the coins sit in it:
One honest detail, because someone will find it and it is better said here first: the original founder address is not frozen and is not empty. It has gone on mining like any other address, so its balance grows. None of that is premine — it is block rewards earned under the same rules available to anyone with a computer. The thing that was permanently removed is the genesis allocation, and the burn address is where you check that.
Where new coins come from
Two ways, and only two. Mining means your computer repeatedly hashes a candidate block until it finds one whose hash lands below a difficulty target; the network accepts it and pays a block reward. Staking means the chain gives an address a chance, proportional to its balance, to produce a block without doing that work, for a much smaller reward. There is no other mint. No one can create OCN by editing a database, and a node that tried would simply be rejected by every other node.
The block reward starts at 100 OCN and shrinks smoothly and permanently — about 3% of its distance above a floor of 0.5 OCN each year, chosen because 3% is roughly the long-run historical average rate of US consumer-price inflation. It approaches that floor forever without ever reaching it, so there is no fixed maximum supply and no halving cliff. This is a design choice with a real trade-off, stated plainly: miners are always paid something, so the chain never has to survive on transaction fees alone, and in exchange the supply has no hard cap.
What it is not
This document makes no claim about what OCN is worth or will be worth, and it will not make one. There is no treasury, no founder allocation, and nobody whose position depends on other people arriving. That is the entire offer.
O-Coin is published as a technical project under the MIT licence: you can read all of it, run all of it, change it, and fork it without asking. That is the entire offer. Every rule stated on this page is a line in that repository, and every number is one you can read off the running chain — so nothing here has to be taken on trust.
It is also unfinished in specific, documented ways. Part 3 lists them. A project that tells you what it has not built yet is easier to evaluate than one that only lists what it has.
2 · Technical specification
Every constant below is a named value in blockchain.py in the O-Coin repository. Current live values are readable at /status.
2.1 Ledger model
Account-based, not UTXO. The chain maintains a balance index keyed by (address, asset), rebuilt from history at load and updated per block. Multi-asset from the ground up: OCN is the native asset, with additional assets (notably the staking receipt stOCN) tracked on the same ledger.
2.2 Keys and addresses
| Signature scheme | ECDSA over SECP256k1 — the same curve Bitcoin uses |
| Address derivation | sha256(public_key_bytes).hexdigest()[:40] |
| Address length | 160 bits, 40 hexadecimal characters |
Truncation to 160 bits is for a shorter, friendlier address, the same reasoning Bitcoin and Ethereum both hash a public key down rather than using it directly. Whoever holds the private key is the only party who can authorise a spend; the node software cannot move coins from an address it does not hold a key for, and neither can its operator.
2.3 Transactions
A transaction is signed over a canonical JSON serialisation, keys sorted, of exactly these fields: sender, recipient, amount, fee, timestamp — plus op and op_data when the transaction carries an operation (asset transfer, staking pool deposit or withdrawal, liquidity add or remove, swap).
Two properties of that list are deliberate. The fee is inside the signed message, so a transaction cannot be intercepted in flight and have its fee rewritten before a miner sees it. And op/op_data are omitted entirely when unset, so a plain transfer produces byte-identical output to what it produced before those fields existed — every signature ever made on this chain still verifies. The signature and public key are excluded from the signed message, since signing over your own signature is circular.
Coinbase transactions (block rewards) use sender = "0", carry no signature, and are rejected if they attempt to carry an operation.
2.4 Proof of work
| Hash function | Scrypt, N=1024, r=1, p=1 — Litecoin and Dogecoin's parameters |
| Hashed header | index, timestamp, merkle_root, previous_hash, target, nonce |
| Target block time | 15 seconds |
Scrypt rather than plain SHA-256 because it is memory-hard: each attempt has to allocate and shuffle a real working buffer, which narrows the advantage purpose-built mining hardware holds over an ordinary computer. The hash function is defined in exactly one module, pow_hash.py, imported by both the node's validator and the standalone miner — they previously held separate copies, which drifted apart once during development and produced a miner whose every submission was silently rejected.
A block commits to its transaction set through a Merkle root, so altering any transaction in a mined block invalidates its hash, and with it every block after.
2.5 Difficulty retargeting
| Retarget interval | every 10 blocks |
| Maximum adjustment | 4× harder or easier per retarget |
| Easiest permitted target | 2256 / 28 |
| Initial target | 2256 / 213 |
Every 10 proof-of-work blocks, the chain compares how long that batch actually took against how long it should have taken and adjusts. The 4× clamp is standard anti-whiplash protection: a large amount of hashpower arriving or leaving at once moves difficulty quickly but not catastrophically.
2.6 Emission
| Base reward | 100 OCN |
| Floor | 0.5 OCN — approached asymptotically, never reached |
| Decay | 3% of the distance above the floor per year of blocks |
| Maximum supply | none — emission continues indefinitely at the floor |
Not a halving. The reward decays exponentially and continuously, so it is always slightly smaller than it was, which keeps it responsive rather than letting it flatten into a step function. The 3% figure is tied to the long-run historical average of US CPI inflation rather than an arbitrary constant — a judgment call, kept as a single named constant precisely so it can be revisited against real data.
Consensus code cannot use floating-point exponentiation. Library implementations of transcendental functions are not guaranteed bit-identical across platforms, so two honest nodes could compute two different "correct" rewards for the same height and fork over nothing at all. O-Coin derives the per-block decay ratio once, offline, bakes it in as a fixed integer literal, and every node then performs only integer multiplication and shifts — fixed-point exponentiation by squaring in Q0.64, the same approach on-chain compound-decay maths uses in Solidity. A startup self-check refuses to run if that literal is ever left stale relative to the constants it was derived from.
2.7 Proof of stake
| Stake weight | an address's current balance, floored to whole coins |
| Difficulty | an entirely separate target with its own retargeting |
| Retarget interval | every 10 PoS blocks |
| Block reward | 10% of the proof-of-work reward at that height |
Peercoin-style, adapted to an account-based ledger. Sub-1-OCN balances carry no stake weight — a deliberate simplification that keeps a float out of a consensus decision. Proof of stake keeps its own difficulty target because PoW and PoS timings measure two unrelated quantities (hashpower against total actively-staking balance), and mixing their timestamps into one retarget window would corrupt both signals.
The reward asymmetry is the point. Proof-of-work rewards have to cover real electricity and hardware, and that cost is what makes attacking the chain expensive. Staking costs almost nothing, so paying it equally would dilute the chain's actual security spend without buying any security in return.
2.8 Fees and mempool
| Fee | flat, 0.01 OCN minimum — not a percentage |
| Mempool capacity | 5,000 transactions |
| Block filling | highest fee first |
A flat fee because the cost a miner bears including one more transaction does not depend on the amount being sent, so charging a percentage punishes larger transfers for nothing. When the mempool is full, an incoming transaction displaces the lowest-fee pending one only if it pays strictly more — the same fee priority the block builder already applies. The cap exists because transaction submission is a public route: anything anyone can call without an account has to be bounded.
2.9 Reorganisation, checkpointing, replay
The longest valid chain wins, with two hard limits. Checkpointing: blocks deeper than 20 are permanent regardless of how long or how validly-mined a competing chain is — the standard mitigation for a small chain's exposure to an attacker who rents more hashpower than it has. Replay protection: a signed transaction can be honoured exactly once, enforced both at submission and independently re-checked inside block validation, so a node cannot be tricked by a replayed transaction even if it accepts a block from a peer.
Worth being precise about what a majority of hashpower could and could not do: it could contest which valid history wins, by producing a longer chain. It could never forge a transaction, because that is blocked by signature verification no matter how much hashpower is behind it.
2.10 Network and persistence
Nodes persist one database row per block, so writing a block is a constant-time append rather than a rewrite of the whole chain. New blocks are gossiped to peers immediately on acceptance rather than waiting for anyone to poll, with /nodes/resolve as the fallback longest-valid-chain sync.
The network is permissionless. Syncing the chain, submitting a transaction, receiving gossip and mining all work without credentials of any kind — verified in July 2026 by having someone with no prior access join the live network from their own machine. There is no shared secret gating participation, and the read routes the explorer on this site uses are the node's own public routes, which means this site is a convenience and never a required intermediary.
2.11 Native pools and the bridge
Staking and the OCN:stOCN automated market maker are native chain operations rather than contracts, addressed by the same provably keyless construction the burn address uses — sha256("STAKE_POOL:OCN") and siblings. A lock-and-mint bridge to wOCN on Ethereum's Sepolia testnet exists and has been exercised in both directions, with replay protection and an immutable daily mint cap.
2.12 Dormant finality layer
A BFT finality gadget (HotStuff-derived, in the family Hyperliquid's HyperBFT belongs to) is implemented and has its own test suites, but is inert. It holds exactly one reach into consensus — a veto against reorganising away a block a committee has finalised — and until a committee actually finalises something, every reorg decision behaves precisely as it always has. Block production, rewards, emission and both consensus mechanisms are untouched by its presence. Activation waits on choosing a real cross-machine validator committee, which is a decision about people, not code.
3 · Roadmap
Ordered roughly by what it would make sense to tackle first. The gap between "a real chain that works" and what Bitcoin, Litecoin or Dogecoin actually run in production is real, and this section is where it is written down rather than glossed.
Done
- Permissionless participation — sync, submit, gossip and mine, no credentials, verified against a genuine outside participant (July 2026).
- Genesis premine burned — block #1169, to a provably keyless address.
- Block explorer and public read API — every block, transaction and address, readable without an account.
- Maintained balance index — balances and stake weights no longer walk the whole chain from genesis on every call.
- Bounded mempool with fee-priority displacement — required once transaction submission became public.
- Native staking and AMM, and a working testnet bridge.
Next
- Peer discovery. Peers are registered by hand today. A real network needs DNS seeds or gossip-based discovery so nodes find each other without a human wiring them together. This is the single biggest gap between O-Coin and a production network.
- A written consensus specification, independent of the Python implementation — the real mark of maturity being that someone could write a second implementation in another language, from the document alone, and have it agree on every block.
- Light clients. Checking a balance or sending a transaction currently requires talking to a full node. Usability at scale means Merkle-proof verification against block headers without replaying the entire chain.
- Full retarget replay in validation. Chain validation currently trusts each block's recorded difficulty target rather than re-deriving what that target should have been for its height. Real chains replay it.
- Mempool policy. No transaction expiry, no eviction under memory pressure, no fee estimation — a production mempool needs all three.
- A separate testnet. There is exactly one network today. Experimentation belongs on a disposable chain that is worthless by design, kept clearly apart.
- Operational hardening. Broader rate limiting and DoS protection, TLS between nodes, and real authentication on any administrative route ever exposed beyond a trusted network.
Gated, deliberately
- BFT committee activation — the code is written and dormant; turning it on requires a real, distributed validator set, not a switch.
- Anything touching real money. The bridge runs on a testnet. A mainnet deployment, or any arrangement involving third-party funds, is gated on qualified legal advice rather than on whether the code is ready. That gate is not a formality and it will not be quietly removed.