THE PAPER01 / 16
eQuity

—Blockchain Policy · TA-1

a record nobody has to be trusted with

Expense auditing and pre-incorporation equity, where the blockchain does exactly one job and the spending never leaves your browser.

Harshit Khemani · 241302081B.Tech CSE (AI/ML), 2024–2028SGT University

Try it yourself

equity.agents.org.in

01The problem

the audit log lives in the database it audits

Whoever administers an expense system can change an amount, swap an approver, or backdate a claim — and then change the log that would have caught them. The control that fails is not the rule. It is the record.

Spending nobody can verify

One database, one administrator, one set of credentials protecting both the data and its audit trail.

Ownership nobody can prove

Before incorporation there is no register of members. A founder split lives in a chat thread with no timestamp and no signature.

02The tension

put it on a chain and you publish your salaries

Moving records onto a public ledger fixes integrity and creates a worse problem. Vendor relationships, payroll and burn rate become world-readable. The usual answer — a permissioned chain — reintroduces the trusted operator the whole exercise was meant to remove.

So: how do you get independent verification without disclosure?

03The insight

one property needs a blockchain. the rest is cost.

What genuinely requires a chain is a public, adversarial timestamp — a commitment that cannot be backdated, cannot be quietly withdrawn, and is witnessed by parties with no relationship to the company. Databases cannot do that. Neither can one timestamping authority, which is a single point of trust and coercion.

Ordering and tamper-evidenceSHA-256 hash chain — on the device
Attributioned25519 signatures — verifiable anywhere
Unforgeable timestampMerkle root in a Solana memo — on chain
ConfidentialityBy omission — only the root is published
Selective disclosureMerkle inclusion proof — on the device

04The product

it is a real thing you can open

Four people, five months of spending in four currencies, and a cap table that exists before the company does. The faces are generated from the wallet addresses — there is no account, no directory, and nothing to look anybody up in.

/appdevnet

Pied Piper · 5 members

  • Richard HendricksFounderAll settled
  • Bertram GilfoyleAdminWaiting to be paid
  • Dinesh ChugtaiApprover1 flagged claim
  • Jared DunnMember1 claim sent back
  • Monica HallAuditorRead-only
/app/expensesdevnet

Expense · approved

Jared Dunn

IndiGo · Travel · 104 days ago

Approved

$311.75

from ₹26,000 INR

1 USD = 83.40 INR · frozen at submission

Signed off byDinesh · Richard
9f2c41a8…d695e7receipt hashed

05Mechanism one

every entry commits to the one before it

Edit an old row and its hash changes, which breaks the link to every entry that followed. Rewriting one line means rewriting the whole tail, in public.

12expense.approvedprev 4e81b03d…9f2c41a8…
13equity.grantedprev 9f2c41a8…3ba07e15…
14anchor.committedprev 3ba07e15…c48d9f02…

06Mechanism two

32 bytes prove a quarter, and reveal none of it

A Merkle root over a batch is written into an SPL Memo transaction. The entries themselves never leave the browser.

/app/ledgerdevnet

On-chain anchor

Anchoredentries 0–51 · slot 298,441,077

SPL Memo payload

eQ1|org_m8kd2p|0-51|6e1ab2c7f4d0a93b5c8e2f71d4a06b93e5c17f8a2d6b04e91c3f7a5d8b2e6d695e7

Vendors, amounts and salaries stayed on the device. Anyone without the entries learns only that a commitment exists.

Public verifiability

Anyone holding the entries can rebuild the tree and check it.

Zero disclosure

Anyone without them learns only that a commitment exists.

Selective proof

One inclusion proof shows one transaction. Nothing else.

07A trap worth naming

a merkle proof can pass on edited data

A tree commits to hashes as stored. Edit an entry’s payload but leave its stored hash alone and the inclusion proof still verifies perfectly — it proves a hash was published, not that this content produced it.

The fix: recompute the entry hash from its own fields and check it against the leaf, in addition to the path. Only the conjunction is reported as verified.

Found while building the MCP server, which re-implements verification independently — the reason it does not simply import the app’s code.

08No backend

there is nothing of yours for us to lose

No accounts, no database, no server-side log. Everything that moves between two people uses a transport we do not operate.

URL fragmentSigned fundraise offers. Fragments are never transmitted to a server.
QR codeThe same payloads, between two devices with no network at all.
SolanaMerkle roots, transfers and payment requests, on a chain nobody owns.
FilesAES-256-GCM backups, and a folder inside storage you already trust.

09Ownership

a cap table that exists before the company does

Founder splits use largest-remainder apportionment, so the parts add back to exactly 100% rather than 99.99%. Options are modelled as options — a right to buy, not stock.

/app/equitydevnet

Pied Piper · fully diluted

9,000,000 shares100.00%
  • Richard Hendricks4,000,000 common44.44%
  • Bertram Gilfoyle2,500,000 common27.78%
  • Dinesh Chugtai1,500,000 common16.67%
  • Option pool1,000,000 reserved · 190,000 granted11.11%

Exact splits

Floor everything, then leftovers go to the largest fractions.

Vesting with cliffs

Recomputed live. Nothing before the cliff, then it all lands at once.

Agents contribute

An agent gets a wallet for attribution; a named operator legally holds the shares.

10Correctness

a rate without its source is barely a rate

An expense stores the amount as incurred, its currency, the rate, and where that rate came from. Store only the converted figure and nobody can later tell 90 EUR at 1.08 from 97 EUR at 1.00.

/app/expensesdevnet

Expense · approved

Jared Dunn

IndiGo · Travel · 104 days ago

Approved

$311.75

from ₹26,000 INR

1 USD = 83.40 INR · frozen at submission

Signed off byDinesh · Richard
9f2c41a8…d695e7receipt hashed

This matters more for crypto than fiat, and structurally: a figure derived from a live price at read time could never participate in the hash. Exclude it and the chain verifies a record with no amounts in it; include it and the hash breaks on the next price tick. Freezing the rate at write is what makes the chain verifiable at all.

11Threat model

including what it does not cover

Edits a stored entryDetected — recomputed hash diverges, every later link breaks
Rewrites the whole suffixDetected once anchored — the published root disagrees
Forges an approvalPrevented — needs the signer's private key
Compromises our hostNothing to take — there is no server and no database
Clears browser storageNot covered — this is what backup and folder sync are for
Steals a recovery phraseNot covered — wallet security is out of scope
Submits a fake receiptNot covered — integrity is not truth

A threat model that claims total coverage is not a threat model.

12Demonstration

the claim is falsifiable, so there is a button for it

The audit view can edit an expense amount behind your back and leave the stored hash alone — exactly what somebody with database access would do.

/app/auditdevnet

Integrity check · after tampering

Chain broken at entry 12. 3 of 54 entries no longer verify.

  • 11 · expense.submitted
  • 12 · expense.approvedRecomputed hash does not match the stored hash
  • 13 · equity.grantedPredecessor hash broken
  • 14 · anchor.committedPredecessor hash broken
1Load the example5 months of real-looking spend across 4 currencies.
2Hit simulate tamperingOne amount quietly changes.
3Watch it breakThat entry and every one after it fails.

A demonstration a sceptic can run in ten seconds beats any assertion in the paper.

13Policy position

evidence, not a filing

A hash-chained, wallet-signed, publicly anchored statement is timestamped, attributable and tamper-evident — properties a court weighs alongside other evidence. It does not create or transfer legal title, and it is not notarisation in any jurisdiction by default.

Securities law is the sharp edge

A publicly posted bearer link can turn a private placement into a public offering. The interface says so where the link is made.

Erasure versus immutability

A real tension, resolved by publishing only roots. A root is not personal data, so there is nothing on chain to erase.

14Honest limits

what it still cannot do

  • 1Anchoring is a policy choiceBetween anchors, only a holder of a prior copy can detect an edit.
  • 2Availability is yoursNo backend means no server-side backup.
  • 3Single-signature treasuryA real treasury belongs behind a multisig.
  • 4Verification needs cooperationThe data holder must supply the entries. Weaker than a fully public ledger.
  • 5Integrity is not truthA fabricated receipt hashes as cleanly as a real one.

15In one line

the blockchain does exactly one job

An unforgeable, non-disclosing, publicly witnessed timestamp. Ordering, attribution, policy and confidentiality are handled by cheaper mechanisms that need no publication at all.

That division is what makes it deployable: a spending record an outsider can verify, and an ownership record that exists before the company does — without publishing your salaries, trusting a vendor, or running a server.

OPEN THE SYSTEMREAD THE PAPER

Try it yourself

equity.agents.org.in