WOTS is mined. The contract is the issuer. No team treasury, no premine, no foundation allocation, no insider round. The schedule is Bitcoin's; the smart contract enforces it.

Mining converts CPU cycles into supply. A miner submits a keccak256 preimage below the current difficulty target. The contract verifies, mints, halves on schedule, retargets every 2,016 mints.

Keccak256 gates issuance. Grover's algorithm reduces hash-preimage search by a square root — not a break. Doubling the difficulty closes the gap. Shor's has no purchase here; there are no elliptic curves inside the puzzle.

SPHINCS-minus / FORS — the signature scheme Vitalik is integrating for Ethereum's post-quantum future — sits on the same primitive. Mining WOTS is mining the cryptographic floor of the chain.

message = keccak256(chainId ‖ contract ‖ signer ‖ epoch)
valid iff keccak256(message ‖ witness) < currentTarget

four properties keep it hard to game

• ▸Messages bound to the signer's address. Solutions cannot be stolen from the mempool.
• ▸Epochs rotate every 100 blocks (~20 min). Pre-computed solutions expire.
• ▸Each (signer, witness, epoch) tuple mints once. Replay is impossible.
• ▸Ten mints per block, hard. No bursts.

reward = BASE_GRANT >> round, where round = totalMints / 100,000.
Base reward is 100 WOTS.

token + hook + miner

0x2C135adbcBbeA49BF8f7d57b2D69F60dB0A520CC