$BUNK is designed for the worst day — regional collapse, severed fiber, no power grid. Build for that, and every other day comes free.
A hand-crank generator powers the shortwave transceiver. No outlet, no battery farm, no dependency.
A Wesolowski Verifiable Delay Function (repeated squaring in a group of unknown order) guarantees fixed elapsed time before the next block can be produced. Real, unfakeable, unskippable time.
Every 6 hours a compact block is transmitted on shortwave and reflected off the ionosphere to the other side of the planet.
Any node with an antenna receives, verifies the VDF, and extends the chain. Coin-weighted Nakamoto consensus, no internet.
Runtime & wallet infra
Tachyon isn't a blocker. The real work lives in the runtime and wallet infrastructure — a bit more complexity to verify blocks that arrived over the air instead of over TCP.
The VDF gives every node a way to agree on ordering and elapsed time without a shared clock or a trusted timestamp server.
Constraints
$BUNK can't depend on hard-to-manufacture components. We assume a base level of globally available manufacturing — roughly 200nm lithography — and a bicycle crank. If a region can make a radio and a bike, it can run a node.
See it live — crank a block on the testnet →
The cryptography
Naive sequential squaring modulo a public prime is not sound: if you know the group order you can jump straight to the answer with fast exponentiation and skip the work entirely. So we don't do that. We use a proper Wesolowski VDF over a group of unknown order.
y = x^(2^T) mod N, computed as T sequential squarings where N is a 2048-bit RSA modulus whose factors are discarded. Without the factorization there is no shortcut. The only path to y is to actually grind all T steps, in order, on one thread.
A Fiat-Shamir hash-to-prime l is drawn from the transcript, and the prover outputs π = x^⌊2^T / l⌋ mod N. That single group element is the proof that the sequential trajectory actually happened, not just a hash of the endpoint.
Anyone checks π^l · x^(2^T mod l) ≡ y (mod N) in a single exponentiation. Verification runs in ~20ms versus ~250ms to evaluate, and it never re-runs the squarings. Tamper with y or π and the check fails.
Live proof, on-chain
We evaluated the VDF over a 2048-bit RSA group, generated the Wesolowski proof, verified it, and committed the transcript digest to Solana mainnet. It is permanent and anyone can verify it.