b.even: Equal Issuance per Person, Progressive Demurrage
and Recirculating Estates in a Permissionless Currency

1Introduction

Most cryptocurrencies distribute new units in proportion to resources their holders already control: hashing power under proof of work [1], stake under proof of stake, or early allocations to founders and investors in token launches. Holdings concentrate accordingly, and the people who arrive later inherit a distribution they had no part in shaping.

Two further failures recur. In a rug pull, the deployer of a token withdraws the liquidity that makes it tradable, leaving holders with an asset no one can buy. And coins whose keys are lost stay out of circulation forever: a sizeable fraction of the bitcoin ever mined is widely believed to be permanently inaccessible.

b.even is designed around a different allocation rule: one person, one share. Each verified person may claim the same amount each month, and the protocol acts continuously against concentration. This paper makes the following contributions:

• An issuance rule that pays every active person the same amount, capped per person and bounded in aggregate by a fixed fraction of the remaining supply (Section 5).
• A progressive demurrage, the whale brake, whose brackets are multiples of the average balance per person and which charges wallets without a verified person at the top rate (Section 6).
• A revenue model in which rewards come from fees rather than from new issuance: half of swap fees is burned, while the brake and paid human checks flow back to persons, and donations can be directed to the persons of one country (Section 7); and an in-coin credit facility that cannot create uncovered debt (Section 8).
• Estate handling that returns the coins of people who have died or lost access, either to a chosen heir or to the equal pot (Section 9).
• An owner-less contract with permanent liquidity, in which only the identity provider can be replaced, by vote (Section 11), and an evaluation by testing and simulation (Section 13).

2Background and related work

Proof of personhood. Borge et al. proposed tying participation in a permissionless system to physical persons rather than to resources [2]; Ford surveys the design space and its trade-offs between inclusion, security and privacy [3]. Deployed systems differ in how they establish uniqueness: iris scans by dedicated hardware in World [4], social-graph analysis in BrightID, video submissions and vouching in Proof of Humanity, and trust graphs between personal currencies in Circles [5]. GoodDollar distributes a basic-income token funded by staking yield [6].

Passport proofs. Machine-readable passports carry a chip whose data groups are signed by the issuing state under the ICAO Doc 9303 public-key infrastructure [7]. Zero-knowledge circuits can verify that signature chain and disclose selected attributes only. We use the Self protocol [8], which derives a scope-specific nullifier from the document so that the same passport yields the same identifier within b.even and unlinkable identifiers elsewhere.

Demurrage. A holding fee on money was proposed by Gesell [9] to discourage hoarding, and has been tried in local currencies. b.even applies demurrage only above a threshold tied to the average balance per person, so it acts on concentration rather than on ordinary saving.

Automated market makers. The contract embeds a constant-product market maker in the style of Uniswap v2 [10], holding BEVN against the native coin of the chain. Unlike a typical deployment, its liquidity position belongs to the contract and cannot be withdrawn.

3Model and assumptions

Time advances in epochs of 30 days. A person is an identifier produced by the identity provider; each person binds one personal wallet at a time. Other actors are relayers, who submit transactions on behalf of persons for a fee; applications, which pay to check that a wallet belongs to a person; donors; and lenders.

We assume: (A1) the identity provider maps each valid passport to a stable person identifier within our scope and cannot link it to identifiers in other scopes; (A2) a state can issue passports at will, so sybil resistance against a state is bounded by the per-country cap of Section 4; (A3) the underlying chain remains live and does not censor b.even transactions indefinitely.

The adversaries we consider are holders who accumulate a large share of supply (whales), operators of fake identities, states, the deployer, and searchers who extract value by ordering transactions.

4Identity

Enrolment. The person holds a passport or a European identity card against a phone. The app reads the chip over NFC and produces a zero-knowledge proof that the chip data is signed by a recognised country signing certificate, that the holder is at least 18 years old, and that the document belongs to a given issuing state. The contract receives the person identifier and the issuing state, nothing else. No photograph or selfie is collected.

Presence. Each epoch, the person confirms presence with a passkey, unlocked by fingerprint or face recognition on the device. The passport is requested again every 4 epochs during the first year and every 12 epochs afterwards. A person who has not checked in for 6 epochs is dormant and stops earning.

Risk index. Some patterns trigger an early document check: more than 10 incoming transfers of at least w_{\min} within an epoch, a transfer of that size to or from a person already flagged, and a random audit of 5% of persons per epoch, seeded from the block’s prevrandao. The floor w_{\min} is set to one year of claims (6 BEVN), so everyday payments between people do not count, and a person who showed their document in the last three epochs is not flagged again, so a merchant who sells to many people is not asked every month. A flagged person who does not revalidate stops earning. Balances are never frozen.

Per-country cap. To bound what a single state can obtain by issuing documents, the number of persons registered from country c is limited to

where H is the number of registered persons overall, F = 10{,}000 and \sigma = 0.15. Registration from a country that has reached its cap is refused until the cap grows.

5Issuance

The maximum supply is S_{\max} = 21{,}000{,}000 BEVN with 18 decimals. Let A_e be the amount allocated up to epoch e, including the launch auction and the initial pool, and n_e the number of persons who checked in during epoch e. Each of them may claim

with per-person cap c = 0.5 BEVN and budget rate \rho = 0.01. There is no halving: a person who joins in the tenth year receives what a person who joined in the first year received, as long as the cap binds. The first term is binding while fewer than \rho(S_{\max}-A_e)/c persons participate, about 380,000 at launch; once n_e is larger, the second term applies and the remaining supply decays geometrically:

The half-life of the remaining supply is then \ln 2 / {-\ln(1-\rho)} \approx 69 epochs, or about 5.8 years. Starting from the 2 million BEVN allocated at launch, 19.3 million are allocated after 20 years (Figure 1). Burned coins are never returned to the issuance budget.

A claim for epoch e is paid once the epoch has closed, together with the person’s share of the equal pot and of any donation directed to their country (Section 7). A relayer that submits the check-in receives 1% of the claim.

Proof. New units are created only by claims and at launch, and each creation increases A_e by the same amount. By Equation (2), the total claimed in an epoch is at most \rho(S_{\max}-A_e) < S_{\max}-A_e. Burning moves units from the supply to the burned amount without changing their sum.

6The whale brake

Threshold. Let S_e be the circulating supply and H_e the number of counted persons. The target threshold is T^\ast_e = k\,S_e/H_e, with k = 8, that is, eight times the average balance per person. The threshold used for charging moves towards the target with damping \delta = 0.5, by at most \mu = 50\% per epoch, and never below T_{\min} = 100 BEVN:

Brackets. For a person with free balance b and locked amount \ell, the lock occupies the threshold first, and the excess is x = b - \max(0, T - \ell). The charge per epoch is

with \beta_1 = 1 and \beta_2 = 5. Total holdings up to 2T (16 times the average) are free; the part between 2T and 6T (48 times the average) pays R_1; the part above pays R_2. The per-epoch rates are set from annual rates by R = 1 - (1 - R^{\mathrm{yr}})^{1/12}, giving R_1 \approx 0.427\% for 5% a year and R_2 \approx 4.17\% for 40% a year. A wallet that does not belong to a verified person pays R_2 on its whole balance. The contract itself and its pool are exempt.

Proof. Every marginal rate in Equation (5) is at most R_2, so \tau(x) \le R_2\, x for the verified wallet. Any amount y moved to unverified wallets pays R_2\, y, which is at least the reduction it causes in \tau.

Splitting across other verified persons requires their cooperation and transfers ownership to them, which the identity layer makes costly to fake at scale. Calibration is discussed in Section 13: with k = 8, a holder who starts with 10% of the maximum supply ends a ten-year simulation with 1.6% of it, against 19.8% without the brake.

7Revenue and rewards

Rewards are paid from revenue, not from issuance. Revenue has four sources: the whale brake; a fee of 0.15% on every swap, in addition to the 0.15% that stays in the pool; fees paid by applications that call checkHuman to verify that a wallet belongs to a person, paid in the native coin and used to buy BEVN from the pool; and donations, which buy BEVN and go entirely to the equal pot.

Revenue is split according to its source. Of swap fees, a share \beta_b = 0.5 is burned, a share \beta_q = 0.2 goes to the equal pot and the remaining 0.3 goes to persons with locked coins. Revenue from circulation, the brake and human checks, is not burned: 0.7 goes to the equal pot and 0.3 to persons with locked coins. Burning only part of the swap fees keeps the supply falling slowly, while the coins the brake takes from large holdings return to everyone; Section 13 shows that this keeps income per person from shrinking over time. Locked coins earn in proportion to their weight

where a is the locked amount, d the person’s outstanding debt (Section 8), L the lock length in epochs, L_{\min}=1, L_{\max}=6 and M=2. The weight is zero for dormant or flagged persons. The equal pot is divided evenly among the persons who checked in during the epoch. Distribution uses a reward-per-weight accumulator, so each update costs constant gas regardless of the number of persons.

By default, new claims are added to a three-epoch lock that is extended with each claim. A person can switch this off at any time.

Directed donations. A donor may direct a donation to the persons of one issuing state c. The native coin buys BEVN from the pool, and the amount D_{e,c} received during epoch e is shared by the n_{e,c} persons of that state who checked in during the epoch, each receiving \lfloor D_{e,c}/n_{e,c} \rfloor with their claim. If no person of that state checked in, anyone may move D_{e,c} to the equal pot once the epoch has closed, so that nothing remains stuck. The facility is meant for cash-transfer programmes run by governments and charities, which need to reach real and unique persons at low cost. The issuing state of each person is already part of the proof submitted at registration; the contract stores it to count check-ins per state.

8Credit within the coin

Persons can lend BEVN to a common loan pool and withdraw unborrowed funds at any time. A person with locked amount a may borrow up to \lambda a from the pool, with \lambda = 0.3, at a capped interest of \iota = 0.4\% per epoch. The debt falls due when the lock ends. One epoch after the due date, anyone may settle the loan: the debt is repaid from the lock, and a penalty of \pi = 10\% of the debt is moved from the lock to the equal pot.

Proof. At origination d \le \lambda a. The lock cannot be released while debt is outstanding, and debt grows by a factor (1+\iota) per epoch. Since locks last at most L_{\max} = 6 epochs and settlement opens one epoch after maturity, d(1+\pi) \le \lambda a (1+\iota)^{7} (1+\pi) \approx 0.34\,a < a. Even unsettled, debt would need \ln(1/\lambda)/\ln(1+\iota) \approx 302 epochs to reach a.

Hence a total default, in which no borrower repays, leaves lenders whole: every loan is settled from its lock. The borrowed coins are already in circulation, so the effect on price is that of the original sale, not of a new one.

9Estates

A person can name an heir in the app, and change or remove the heir at any time. After 12 epochs without a check-in, anyone may open an inheritance, which gives 3 epochs of notice; any check-in by the person during that time cancels it. After the notice, the heir, who must be a verified person, receives the free balance and the lock. Without an heir, the person’s balance is swept to the equal pot once 36 epochs have passed without a check-in. No coin stays stuck indefinitely.

10Launch and liquidity

The first two epochs are for check-ins only. In the third epoch, a uniform-price auction sells 1,000,000 BEVN for the native coin, with at most 29,000 CELO per person and a total cap of 11,000,000 CELO. At the price of 10 October 2026 (about EUR 0.086 per CELO) the cap is about EUR 950,000, below the EUR 1,000,000 threshold under which Article 4(2) of the Markets in Crypto-Assets Regulation [11] exempts small offers from its white-paper requirements; this reading requires legal review. The proceeds and another 1,000,000 BEVN seed the constant-product pool, whose position belongs to the contract and cannot be withdrawn. Nothing is allocated to the team, to investors or to the deployer.

11Governance

The contract has no owner, no pause, no blacklist and no upgrade path. Its monetary parameters are fixed at deployment and published in a single Configured event. The one exception is the identity provider, which may have to be replaced if it is compromised or discontinued. Any person may propose a successor. Voting lasts 2 epochs and requires a quorum of 30% of persons and a two-thirds majority. A passed proposal waits 3 epochs before execution, after which persons have 6 epochs to rebind their identity with the new provider; per-generation alias keys carry their history across. A vote cannot change issuance, brackets or fees.

12Implementation

The contract is written in Solidity 0.8.28, compiled through the IR pipeline into a single contract of about 23.4 KB, below the 24,576-byte limit. It implements the ERC-20 interface, the market maker, identity binding, issuance, the brake, revenue distribution, credit, estates and succession. It targets Celo [12], an Ethereum layer-2 network with a native-coin pool pair; relayers pay gas so that persons need not hold the native coin. A deployment rehearsal on a fork of the Celo Sepolia test network used about 8.0 million gas.

13Evaluation

Testing. The repository contains 101 tests, among them five invariants checked under stateful fuzzing: conservation of tokens across balances, locks, pots and the pool; the supply bound of Proposition 1; full backing of the pool’s native-coin reserve; consistency of lock totals; and the debt bound of Proposition 3. Handlers were tuned until every feature, including inheritance, sweeps, loan settlement and directed donations, was reached by the fuzzer.

Agent-based simulation. We simulated 400 agents standing for 100,000 persons (supply and auction divided by 250) over 48 epochs, against the contract bytecode. Each epoch, 40% of agents check in, 30% switch off the automatic lock, sellers sell 60% of their free balance, 20% of agents also buy for EUR 1 per active person, and applications spend EUR 0.25 per active person on human checks. Conservation was verified at the end of every epoch. Table 2 reports the pool price relative to the auction price.

The whale buys half of the pool’s native reserve and holds; it reaches 20.0% of supply, which the brake and continued issuance reduce to 16.0% after 12 epochs, 12.1% after 24 and 7.4% after 47. The decline is slower than under the previous design (4.9% after 47 epochs) because fewer new coins are issued: this is the cost of protecting the price. The state scenario adds five fabricated persons per real one, all checking in and selling, with no per-country cap; they capture 94% of issuance, but total issuance does not grow, since the budget is fixed. This is the case the per-country cap is meant to bound. In the panic scenario every agent exits from epoch 24; the price falls to 14% of the auction price (2% under the previous design), but all locks end and every agent can sell. With loans enabled and half of the lockers borrowing the maximum, debt never exceeded locked amounts.

Market scenarios. A monthly market model was run on 4,000 scenarios drawn from ranges based on observed behaviour: the fraction of free coins sold (0.4 to 0.9, after airdrop studies [13]), the share of registered persons active each month (0.1 to 0.6, after GoodDollar [6]), the share keeping the automatic lock, external demand per active person (EUR 0.1 to 5, log-uniform), spending on human checks, and the number of registered persons (10,000 to 1,000,000, log-uniform). Table 3 compares designs on the same scenarios.

The last row uses the extended model described below, which reproduces the previous row within two points. Under the current design, the worst decile of scenarios ends the second year at 0.96 of the auction price. For the previous design, by rank correlation with the price at 24 months, external demand dominates (+0.65), followed by the number of registered persons (+0.30) and the fraction sold (-0.25). With demand of EUR 2 to 5 per active person and less than 55% of free coins sold, the price is at or above the auction price after 24 months in 83% of scenarios; below EUR 0.5 of demand, in at most 11%. The design limits the damage of selling, but it does not create demand.

Income at scale. We extended the market model to 20 years, with the brake (1% to 4% of holdings per year), directed and undirected donations (EUR 0.01 to 2 per active person per month), paid human checks, and up to 10 million registered persons, and split each month into interleaved trades. Income is the claim plus the equal-pot share per person, at market value, with the auction price set to EUR 1. Over 4,000 scenarios, the median income under the current design is EUR 1.91, 1.95 and 1.90 per month after 5, 10 and 20 years, while under the previous design it falls from 2.09 to 1.47; a flat demurrage of 1% or 2% a year on all balances lowers it, under the assumption that it deters buyers. Across scenarios, income per person is about 1.45 times the money that enters per person per month from buyers, donors and applications. Table 4 gives the inflow needed for given incomes after ten years.

Brake calibration. Table 5 shows a ten-year simulation of 2,000 persons in which one holder starts with 10% of the maximum supply, under several settings of k and the rates.

We chose k=8 as a balance: it leaves room for persons to accumulate up to 16 times the average without any charge while still removing most of an initial concentration within a decade.

14Limitations and risks

Identity provider. The design depends on the soundness and availability of the passport proofs. The Self hub contract is an upgradeable proxy, and at the time of writing we have not established who controls upgrades. Chip cloning is not prevented on documents without active authentication. Succession (Section 11) mitigates discontinuation, not a silent compromise.

Exclusion. People without a chipped passport or identity card cannot take part. This excludes a large share of the world’s poorest, for whom a basic income would matter most.

States. A state can issue documents. The per-country cap bounds its share, but up to 15% of persons may still come from a single country once the network is large.

Value and income. Nothing guarantees a price. Table 3 shows that the outcome depends mainly on external demand, which the protocol cannot create, and Table 4 shows that an income that matters for millions of persons requires hundreds of millions of euros entering each month. The design can only pass that money on without loss.

Immutability. A bug cannot be patched; persons can only migrate to a new contract. Two independent audits are planned before any main-network deployment.

Chain. Celo’s layer-2 sequencer is currently operated centrally; it can delay transactions but cannot alter contract rules.

Regulation. The classification of BEVN under MiCA and other regimes has not been reviewed by counsel. Exchange wallets would be charged at the top rate, so listing on centralised exchanges is not expected.

15Conclusion

b.even replaces allocation by capital with allocation by person, and replaces a static distribution with one that drifts back towards equality: large holdings pay a progressive charge that returns to everyone, swap fees are partly burned, and coins left behind by dormant accounts or deaths return to circulation. The contract leaves no one in control of supply or liquidity. Simulation suggests that the mechanism contains concentration and the damage from selling, while the price remains a question of demand. Its income is whatever money enters, passed on equally; directed donations make it a channel for cash-transfer programmes. The next steps are deployment on a test network, a closed pilot with a few hundred people, legal review and independent audits.

ALaunch parameters

References

1. [1]S. Nakamoto. Bitcoin: A peer-to-peer electronic cash system. 2008.
2. [2]M. Borge, E. Kokoris-Kogias, P. Jovanovic, L. Gasser, N. Gailly and B. Ford. Proof-of-personhood: Redemocratizing permissionless cryptocurrencies. In IEEE European Symposium on Security and Privacy Workshops, 2017.
3. [3]B. Ford. Identity and personhood in digital democracy: Evaluating inclusion, equality, security, and privacy in pseudonym parties and other proofs of personhood. arXiv:2011.02412, 2020.
4. [4]Tools for Humanity. World whitepaper. 2023.
5. [5]Circles. Circles UBI documentation. Accessed October 2026.
6. [6]GoodDollar. GoodDollar protocol documentation. Accessed October 2026.
7. [7]International Civil Aviation Organization. Doc 9303: Machine Readable Travel Documents, 8th edition, 2021.
8. [8]Self. Self protocol documentation. Accessed October 2026.
9. [9]S. Gesell. Die natürliche Wirtschaftsordnung durch Freiland und Freigeld. 1916.
10. [10]H. Adams, N. Zinsmeister and D. Robinson. Uniswap v2 core. 2020.
11. [11]Regulation (EU) 2023/1114 of the European Parliament and of the Council on markets in crypto-assets. Official Journal of the European Union, L 150, 2023.
12. [12]Celo. Celo documentation. Accessed October 2026.
13. [13]J. Messias, A. Yaish and B. Livshits. Airdrops: Giving money away is harder than it seems. arXiv:2312.02752, 2023.