igneum/docs/analysis/security-budget.md

Security budget stress: emission through six halvings at three price inputs

3 October 2026. Arithmetic on the emission schedule of spec 2.5 at three coin prices. The prices are inputs chosen to span two orders of magnitude so the arithmetic can be read; they are assumptions, not predictions, and nothing here says what the coin will be worth. The question the table answers: at each price, in which year does the money reaching miners fall below a stated floor, with low fees and no external proving demand.

1. Inputs

Input	Value	Label
Emission, years 1 and 2	1,000,000,000 IGN per year of 365.25 days, minus the 30-day ramp in year 1 (about 37 million IGN never minted)	Implemented, spec 2.5
Halving	Every 63,115,200 DAA seconds (two years), at the start of years 3, 5, 7, 9, 11 and 13: six halvings in the table	Implemented, spec 2.5
Split	80% to the block producer, 20% to the proving pool	Implemented, spec 2.5
Low price	USD 0.005 per IGN (USD 20 million at the cap)	Assumption
Base price	USD 0.02 per IGN (USD 80 million at the cap)	Assumption
High price	USD 0.10 per IGN (USD 400 million at the cap)	Assumption
Low fees	Priority fees reaching miners and provers: USD 20,000 per year in total. Burns (base fee in both dimensions, unregistered app share): USD 30,000 per year	Assumption, chosen so that fees are too small to matter; both are flat across the years on purpose
External proving demand	Zero. No IGN-settled jobs, so no 10% job burn and no job revenue to provers	Assumption
Block rate	One block a second at launch; the emission is per DAA second, so the block rate does not change the yearly figure	Spec 2.5

The price stays constant across all 14 years in each column. That is the point of the exercise: the table shows what the schedule alone does, with no appreciation to rescue it.

2. Emission by year

Year	Halvings so far	Emission, million IGN	To miners (80%), million IGN	To provers (20%), million IGN
1	0	963.0	770.4	192.6
2	0	1,000.0	800.0	200.0
3	1	500.0	400.0	100.0
4	1	500.0	400.0	100.0
5	2	250.0	200.0	50.0
6	2	250.0	200.0	50.0
7	3	125.0	100.0	25.0
8	3	125.0	100.0	25.0
9	4	62.5	50.0	12.5
10	4	62.5	50.0	12.5
11	5	31.25	25.0	6.25
12	5	31.25	25.0	6.25
13	6	15.625	12.5	3.125
14	6	15.625	12.5	3.125

Sum through year 14: 3,931 million IGN of the 4,000 million cap.

3. Dollars to miners, by price input

Emission only. Add USD 16,000 a year for the miners' part of the low-fee assumption (80% of USD 20,000); it does not change any row.

Year	Low, USD 0.005	Base, USD 0.02	High, USD 0.10
1	3,852,000	15,408,000	77,040,000
2	4,000,000	16,000,000	80,000,000
3	2,000,000	8,000,000	40,000,000
4	2,000,000	8,000,000	40,000,000
5	1,000,000	4,000,000	20,000,000
6	1,000,000	4,000,000	20,000,000
7	500,000	2,000,000	10,000,000
8	500,000	2,000,000	10,000,000
9	250,000	1,000,000	5,000,000
10	250,000	1,000,000	5,000,000
11	125,000	500,000	2,500,000
12	125,000	500,000	2,500,000
13	62,500	250,000	1,250,000
14	62,500	250,000	1,250,000

4. Dollars to provers, by price input

Emission only. Add USD 4,000 a year for the provers' part of the low-fee assumption. With no external demand this is the whole proving income.

Year	Low, USD 0.005	Base, USD 0.02	High, USD 0.10
1	963,000	3,852,000	19,260,000
2	1,000,000	4,000,000	20,000,000
3	500,000	2,000,000	10,000,000
4	500,000	2,000,000	10,000,000
5	250,000	1,000,000	5,000,000
6	250,000	1,000,000	5,000,000
7	125,000	500,000	2,500,000
8	125,000	500,000	2,500,000
9	62,500	250,000	1,250,000
10	62,500	250,000	1,250,000
11	31,250	125,000	625,000
12	31,250	125,000	625,000
13	15,625	62,500	312,500
14	15,625	62,500	312,500

5. Burns, separately

Burns reach nobody. They are listed so that nobody adds them to the security budget by mistake.

Burn	Rule	Under the assumptions
Base fee, both gas dimensions	100% burned (spec 5.1)	Inside the USD 30,000 per year assumption
Unregistered app share	The 20% of a priority fee attributed to a contract with no registered developer is burned (spec 5.2)	Inside the USD 30,000
10% of IGN-settled external jobs	Burned (spec 5.4)	Zero, because external demand is zero
The launch ramp	About 37 million IGN never minted (spec 2.5)	Not a burn; listed because it is the only other supply reduction

A burn is not security spend. The base fee being burned in full means usage of the chain, by itself, pays miners nothing; only the priority fee does. That is Ethereum's rule and the trade-off is stated here rather than hidden: it removes wash-gas attacks on block space (ledger E3) at the cost of fee revenue to security.

6. The floor

The floor: USD 1,000,000 per year reaching miners.

Why that number. It is the electricity, at USD 0.12 per kWh, of about 3,000 consumer cards at 300 W running all year (3,000 x 0.3 kW x 8,766 h x 0.12 = about USD 946,000, approximate). 3,000 cards is the fleet size at which one operator with 1,000 cards, a single mid-size farm, approximate, holds one third of the 30-day vote weight. One third is the threshold the litepaper names: beyond it two locks can coexist under a partition (spec 3.7 item 1). Below the floor the schedule cannot pay for a fleet large enough to keep a single ordinary farm under a third, so finality's safety rests on fewer, larger parties. The floor is about miners because the finality weight is blue blocks, which only miners make; the provers' line is the proving capacity, not the security of history.

Readers with a different electricity price or card count can scale the floor; the year it is crossed moves by at most one halving for a 2x change in the floor.

7. When the floor is crossed

Price input	Years at or above the floor (emission to miners)	First year below the floor	What emission to miners is that year
Low, USD 0.005	1 to 6 (years 5 and 6 sit on the floor at USD 1,000,000)	Year 7, after the third halving	USD 500,000
Base, USD 0.02	1 to 10 (years 9 and 10 sit on the floor)	Year 11, after the fifth halving	USD 500,000
High, USD 0.10	1 to 14	Not within six halvings; year 15 would be USD 625,000	USD 1,250,000 in years 13 and 14

Under the low input the chain has six years before the schedule stops paying for the floor fleet. Under the base input, ten. Under the high input, more than fourteen. In every column the crossing comes, because the schedule halves for ever and the price is held flat.

8. What the design relies on by the crossing year, and what it does not

Relies on	How much, in the low case at year 7	Where the rule is
Priority fees to miners	The shortfall is USD 500,000 a year, which at USD 0.005 is 100 million IGN a year, or about 3.2 IGN of miner priority fee per block at one block a second (100,000,000 / 31,557,600). The chain needs that much tip volume, or the floor is not met	Spec 5.2: 80% of the priority fee to the producer and provers
In-chain proving demand through the tip share	The provers' part of the 80% is the same tip volume; it does not add to the miners' line	Spec 5.2, 5.3
External proving demand	Pays provers 90% of job fees and burns 10% once settled in IGN. It does not pay miners and does not count toward the floor. It keeps cards on, which is a proving-capacity benefit and not a hashrate benefit, because the lottery and the proving are separate on purpose	Spec 5.4; CLAUDE.md (Aleo lesson)
The block rate steps (4 and 10 blocks a second)	Change nothing: emission is per DAA second, not per block	Spec 2.5

Does not rely on	Why it is not in the table
Price appreciation	The price is flat in every column. A column with a rising price would move the crossing year, and it would be a prediction
Burns	They reach nobody (section 5)
A tail emission	None exists. Spec 2.5 and the litepaper state the halving schedule as a bet; a tail can be added only by a 90% upgrade signal (spec 5.7). This table is the case for keeping that door open, not a decision to use it
A treasury or a fee to the team	None exists

9. What this analysis does not do

• It does not model hashrate. Dollars to miners is not hashrate; it is the ceiling on what hashrate can be paid for.
• It does not model fee growth, user growth or proving demand growth. Those are the things the design relies on, and this file says so instead of assuming numbers for them.
• It does not compare with other chains. Bitcoin's and Kaspa's security budgets after their halvings are a known discussion, approximate, and belong in a cited comparison, not here.
• It does not set policy. The decision it informs (whether a tail emission should be specified before genesis or left to the 90% signal) has no open item in docs/spec/06-open-items.md yet; today the spec leaves it to the signal, and this file is the reason to add one.