NAME#

tfn: a Solana launchpad where a new coin's opening supply can't be bought. It can only be mined with proof-of-work.

SYNOPSIS#

launch(1)  name ticker image --dig 5|10|15     # about 0.04 SOL, no dev bag
mine(2)    --coin TICKER                        # hash in the browser, earn shares
open(2)    --coin TICKER                        # anyone, after the last block
claim(2)   --coin TICKER                        # mint your tokens to your wallet

For the first 5, 10 or 15 minutes of a coin's life the token doesn't exist. The only way to earn it is to submit proof-of-work. When the dig ends, the program creates a Meteora pool with the rest of the supply, trading starts, and miners claim. Bundlers and snipers have nothing to buy, and 200 wallets don't hash any faster than one.

LIFE OF A COIN#

launch ──> the dig (30/60/90 blocks of 10 s, mined only) ──> open (Meteora pool, locked) ──> claim / collect

The mint has no freeze authority. Its mint authority is the coin's program address, and the metadata is immutable. Once every earned token is claimed, anyone can call seal to drop the mint authority for good.

THE DIG#

• Blocks are 10 seconds. The dig starts at launch.
• Every block pays the same. No halvings, so showing up late isn't a penalty and nobody takes half the supply in the first minute.
• Shares, not one winner. Every hash below the target is one share. A block's reward is split by shares, so a laptop doing 1% of the work gets 1% of every block.
• Empty blocks roll over. A block with no shares passes its reward and the rounding dust to the next block.
• Unearned reward is never minted. Whatever is still unearned after the last block stays unminted.
• Late shares. A share for block n still counts until 3 s after n's window ends, unless someone already closed the block.
• Lazy close. The first submission or crank after a window closes the block, prices it (tokens per share), retargets, and opens the next block with a fresh challenge.

THE SHARE HASH#

Each block has a challenge. Every share is a hash of that challenge, the miner's wallet and a nonce.

challenge = keccak256( mint[32] || u64_le(block_index)[8] || slot_hash[32] )     72-byte preimage
share     = keccak256( challenge[32] || beneficiary[32] || u64_le(nonce)[8] )     72-byte preimage
value     = u64 big-endian of share[0..8]
valid     = value < coin.target
expected hashes per share = 2^64 / target

Byte offsets of the share preimage

• Keccak-256, not SHA3-256. Original Keccak with the 0x01 pad byte and rate 136, the same as Ethereum and Solana's sol_keccak256 syscall. js-sha3's keccak256 is right, sha3_256 is wrong.
• block_index is 0-based, encoded as a u64 little-endian even though the account stores a u32. The site shows blocks 1-based.
• slot_hash is the newest entry in the SlotHashes sysvar when the block opened. Miners never compute it; they read coin.challenge from the Coin account.
• Nonces go up. Within a block each beneficiary's nonces must be strictly increasing (each >= miner.next_nonce), so the same share can't be sent twice. Up to 8 shares fit in one transaction.
• Checked on chain. The program re-hashes every share with the keccak syscall: one hash per share, a few hundred compute units.
• Relayers are safe. Because the wallet is inside the hash, anyone can submit shares for you without being able to redirect them.

Check a share yourself

import { keccak256 } from 'js-sha3';

// challenge: 32 bytes from the Coin account, wallet: 32 raw pubkey bytes, nonce: BigInt
function shareHash(challenge, wallet, nonce) {
  const msg = new Uint8Array(72);
  msg.set(challenge, 0);
  msg.set(wallet, 32);
  for (let i = 0; i < 8; i++) msg[64 + i] = Number((nonce >> BigInt(8 * i)) & 0xffn);
  const h = new Uint8Array(keccak256.arrayBuffer(msg));
  const value = h.slice(0, 8).reduce((v, b) => (v << 8n) | BigInt(b), 0n);   // big-endian top 8 bytes
  return { h, value };
}

const { value } = shareHash(challenge, wallet, 41n);
const isShare = value < target;   // target = coin.target (u64)

The program's own tests check this hash against fixed test vectors. Recompute one yourself.

DIFFICULTY#

Bitcoin keeps block time steady by moving difficulty. Our block time is fixed by Solana's clock, so the program keeps the number of shares per block steady instead: the target is S = - shares per block (read live from the config account), about - transactions of 8 shares per block per coin, whatever the miner count.

next_target = target × S × seconds_open / (shares × 10)
clamp       : at most 4x easier or 4x harder per block
empty block : 4x easier
start       : target 2^46  =  262,144 expected hashes per share

• One CPU core running plain JS (about 210 kH/s measured) finds a share about every 1.25 s at the start target. WASM and WebGPU are much faster.
• With few miners the retarget makes shares easier, 4x per block, until shares per block reach S. With many miners it makes them harder.
• More miners means harder shares, not more transactions, so chain load per coin stays flat however big the dig gets.
• The dig page shows difficulty as expected hashes per share and as leading zero bits, live, block by block.
• S is a config value, and each coin keeps the S it launched with. The first mainnet run launched with S = 400. That needs about 5 landed transactions a second across all miners, more than public RPCs let two wallets send, so every block came in short and difficulty eased 4x per block to the easiest setting by the tenth block. S was lowered on chain with update_config, with no redeploy. See the run.

REWARDS AND CLAIMING#

tokens_per_share[b] = (reward_b + carry) / shares_b      # dust rolls into carry
your_tokens         = Σ your_shares[b] × tokens_per_share[b]

1. When your next submission lands in a newer block, your last block is settled into pending at that block's price.
2. After the last block, claim settles whatever is left.
3. claim only works after open. It mints pending to your wallet's token account (created if needed) and closes your miner account, refunding its rent to whoever paid it.
4. There is no claim deadline in the program.

No token exists before the pool does. Nobody holds the coin during the dig, so nobody can sell it, send it or start a rival pool first.

OPENING ON METEORA#

After the last block anyone can call open. In one transaction it closes the last block, mints the 800,000,000 pool tokens and creates a Meteora DAMM v2 customizable pool, coin against SOL.

The opening price floor

The pool starts with zero SOL. Every SOL in it comes from a buyer, so the price in this pool can't go below the opening price. Miners can only sell into real buys. If nobody buys, there's nothing to dump into.

With 80% of supply in the pool, it behaves like a constant-product curve with about 24 SOL of virtual SOL: about 24 SOL of buys roughly 4x the price.

Aggregators pick the pool up by themselves: on the first mainnet run DexScreener and Jupiter listed it within 2 minutes of open, with nothing submitted to either. The dig page links its pool, mint and locked position.

FEES#

launcher : 80% of the position's fees   = 0.64% of volume at the 1% base fee
platform : 20% of the position's fees   = 0.16% of volume, buys back and burns $NONCE0
paid in  : native SOL, by a permissionless crank anyone can call

Nobody has to trust a team bot to pay out. Uncollected fees stay in the position until someone cranks collect. A totally empty recipient wallet can't receive less than about 0.00089 SOL, so collect waits until fees build up.

MINERS#

Browser miner

• WebGPU Keccak kernel when your browser has it, else WASM Web Workers, else plain JS workers. Every share is re-hashed on the main thread before it counts.
• A burner key in your browser signs the mining transactions, so there are no wallet popups while you mine. You top it up once (about 0.015 SOL), which covers the miner account rent (refunded at claim) and fees.
• Your main wallet gets the rewards, because it's the address inside every share.
• Intensity low, medium or high sets how much of your CPU or GPU it uses.
• Measured on a 3-core server: WASM about 2.2 MH/s at medium in Chromium, plain JS about 0.18 MH/s per worker. A real GPU is much faster.

Command line miner

A command line miner mined the first mainnet dig from two wallets (see Proof). It isn't released yet. It uses the same share format, so anything it finds can be checked the same way.

THE PROGRAM#

An Anchor program. Every instruction except the admin ones is permissionless.

Accounts each instruction takes, in order

Account layouts

Anchor borsh: an 8-byte discriminator, then the fields in order.

ADDRESSES#

Solana mainnet. The program is unaudited and upgradeable, and its upgrade authority is the deployer key below. Check any of these on Solscan.

The source of the on-chain program is public at github.com/thefirstnonce/first-nonce-program. That repository is the program only; the site, the miners and the SDK are not open source. Verified build: the deployed program matches this source byte for byte (OtterSec status, Solscan). Executable hash cfa2c3f8dea0f6625ec57a923d24b1c892e14825c0c57679d7d8c1cc5763cc8b.

$NONCE0 is the platform coin, launched separately as a normal Meteora launch, not a mined one. It trades with a 2.5% fee on Meteora, and the creator side of that fee goes to the dev wallet that launched it. 20% of the trading fees from every coin here buy it back and burn it. You don't need it to launch or mine, and holding it pays nothing else. We make no claim about its price.

CHECK IT YOURSELF#

You don't have to trust this page. Each line below runs against the chain, not against us.

The program, its authority and its size

solana program show GUW16mLqFWfGjD5AFFSwDxQyGAFSDvPdEbryVa98TGs3 --url mainnet-beta
# Authority should read Ayq6tRC3atGKuKP6wdt4fX1fSBe1wnBrzMAkCxMatCbG (the deployer, so it is upgradeable)

The source

git clone https://github.com/thefirstnonce/first-nonce-program
# the on-chain program only (Anchor). Solscan verified build: in progress.

The config account

solana account B665MTTAmazzvki2NUcxyfz3yorq5LTvARWngyNRNsN5 --url mainnet-beta --output json
# 218 bytes, owned by the program: admin, treasury, launch fee, fee split, share target, start target …

Live from that account right now: share target - per block, launch fee - SOL, opening value - SOL by default.

A coin and its live challenge

# Coin PDA = seeds ["coin", mint] under the program
solana account <coin address> --url mainnet-beta --output json
# challenge, target and current_block live in this account. The dig page shows the same values.

Recompute a share

Type or paste a challenge, a wallet and a nonce. Your browser hashes them with keccak256 and compares the top 8 bytes to the target. Nothing is sent anywhere. “use the live dig” fills in the current challenge and target.

PROOF#

It already ran on mainnet. On 2026-10-13 a test coin went through the whole life of a coin: a 5-minute dig mined by our command line miner from 2 wallets, 1,889 shares in 238 transactions, then open, a buy and a sell, collect, two claims and seal. No program bug turned up, and nothing was redeployed.

• Supply adds up. After seal: supply 999,999,999.999367 + 0.000589 burned by Meteora at open + 0.000044 never mined = exactly 1,000,000,000.
• The dig. 30 blocks closed in order, by a live share inside the grace, by crank and by the next submission. 6 empty blocks rolled their reward forward. Allocated plus never mined came to exactly 200,000,000.
• Aggregators. DexScreener and Jupiter listed the pool by themselves within 2 minutes of open.
• Compute units on mainnet. launch 122k, submit_shares 57k to 63k, crank 48k to 50k, open 234k, claim 82k to 87k, collect 107k, seal 34k.
• Cost. The launch cost 0.1121 SOL. Each batch of shares paid 5,900 lamports with a small priority fee.
• What changed after it. The run launched with S = 400 shares per block. Two wallets couldn't land the 5 transactions a second that needs, so difficulty eased to the easiest setting. The config now says -, set with update_config. See Difficulty.

The 19 failed submissions in the run were shares for a block the other miner had already closed (BlockClosed) and 4 that overtook each other (NonceNotIncreasing): expected client behaviour, 0.00014 SOL in fees in total. The test tokens are worthless and were never meant to trade.

FAQ#

CAVEATS#

• GPUs beat laptops. More hashing power earns more shares. A browser earns its share, but it won't out-mine a GPU rig. The claim is that nobody takes the launch in one slot, not that laptops win.
• Unaudited and upgradeable. The program has not been audited. Its upgrade authority is the deployer key Ayq6tRC3atGKuKP6wdt4fX1fSBe1wnBrzMAkCxMatCbG, which can change the program. Use amounts you can afford to lose.
• Mining costs SOL. Small but real: network fees on every batch of shares.
• The floor belongs to our pool. It says nothing about the coin's value, and other pools for the same token can exist at any price.
• Preview mode. With ?network=mock the site runs a simulated chain, labelled Demo data. The live site reads Solana mainnet.
• ORE came first with proof-of-work on Solana. We're not affiliated.

SEE ALSO#

explore(1), launch(1), X.

The First Nonce is an independent project. It is not affiliated with, endorsed by or operated by Meteora, ORE, DexScreener or Streamflow.