Skip to main content
The Epoch Treasury is protocol-controlled accounting for aggregate funding and settlement liability. It is not a user balance container. Funding sends SPL tokens directly to the epoch’s treasury token account, and the treasury only tracks the aggregate pending liability. No individual payment escrow, commitment PDA, payment vault, or claim slot is created during funding.

​
How funding works

When a sender funds an epoch, the signed transaction sends tokens directly to the epoch treasury token account. The funding transaction deliberately excludes the opaque slot. The treasury increments its aggregate pending liability to reflect the incoming funds.

​
Opaque slots and the treasury

The opaque slot is derived by Node/Mother with HMAC-SHA256 using TSN_NODE_CLAIM_SLOT_HMAC_SECRET. It is deliberately absent from the funding transaction. The EpochClaimSlot PDA is derived from the epoch treasury and opaque slot, and the TSN program initializes it on the first valid settlement or refund. This means the slot does not appear on chain until settlement or refund occurs. The first valid operation wins atomically. A slot marked SETTLED or REFUNDED can never be reused.

​
Operational visibility

Operational dashboards may show aggregate counts, transaction signatures, and slot resolution status. They never decrypt or persist the private payment binding. The binding is encrypted off-chain by Node/Mother, and the encryption key never leaves Node/Mother.

​
Epoch close gate

An epoch can close only after pending liability reaches zero and every opaque slot is resolved as SETTLED or REFUNDED. This is enforced by the TSN program, not just by Node attestation.