A shared money notebook that keeps working when the internet is bad, down, or being attacked.
The problem
Imagine a village after a storm. No internet, no bank. Five people each keep a notebook of who owns what
(alice has 500, bob has 100). They can only shout notes to each other, and most shouts (80%) get lost in the wind.
How do you make sure everyone's notebook ends up the same, and nobody can cheat?
What you see on the demo page
The 5 circles
Five devices (phones, radios). Each has its own notebook. The two numbers inside are the balances for alice / bob that this device believes.
The moving dots
Messages. Blue = delivered. Red = lost on the way. Devices keep re-sending, so eventually enough get through.
"Do all devices agree?"
Green ✔ means every notebook matches. Red numbers show which device is behind.
The 4 big ideas (and the buttons that show them)
Idea
Simple version
Try it
Mesh30%
Devices talk directly to each other. No central server needed.
Press Send, watch dots fly.
Proof check30%
Every transfer is signed with a real digital signature (ECDSA P-256), like a handwritten signature nobody can fake. Change one digit and the signature breaks. Signing with someone else's key fails. Sending more than you own is refused, and a repeated transfer is ignored. Honest note: this proves who authorised a payment. It is not a zero-knowledge proof, which would also hide the amounts.
Press Cheat: forge signature or Cheat: overspend.
Agreement (CRDT)25%
Devices simply swap the notes they have. Everyone's balance is then worked out from the same pile of notes in the same order, so identical piles always give identical balances, no matter who heard what first or when.
Press Jam the middle, send money on both sides, release it. Or drag nodes apart.
Survives chaos15%
Radios only reach so far, and far links lose more packets. Notes hop device to device. Even at 80% loss, with nodes moving, switched off or attacked, nothing crashes; it is just slower.
Move the Loss and Radio range sliders, tick Nodes move, click a node to switch it off.
Fake-node attack (Sybil)
A "Sybil" attack is one cheater pretending to be many people. The button Attack: fake-node flood floods devices with
forged transactions (including one that tries to drain alice). Because every transfer needs a valid signature, devices throw them all away.
Tick Skip signature checks (unsafe) and try again to watch the forgeries spread and corrupt balances.
Double spending
Story: spend the same money twice splits the map, then alice pays 400 on each side. When the halves reconnect, every device
applies the same fixed rule, keeps one of the two payments and rejects the other. Total money stays at 650, so nothing is created.
The honest limits
Which double-spend wins is decided by a fixed tie-break rule, not by who was "really" first. Real systems add consensus, or hardware or ZK-based balance proofs, for stronger guarantees.
Signatures are real, but they are not zero-knowledge proofs. Starting balances are a fixed shared list, not real identity.
Everything runs in your browser; the optional Ask server to verify button calls a small Vercel function that re-checks the signature.
Quick 60-second tour
Open the demo and press Send. Watch the dots hop from radio to radio, some turning red (lost), until the status turns ✔.
Press Cheat: forge signature and Cheat: overspend. Read the rejections in "What just happened".
Drag a node out of range, or press Jam the middle, send on both sides, then reconnect.
Press Attack: fake-node flood. It's blocked. Tick the unsafe box and try again.
Press Run automated audit to see all four requirements pass.