faq.

is this real post-quantum?

yes. SPHINCS- is the same hash-only signature scheme that vitalik published. its security reduces to the security of keccak256 alone. if it ever breaks, ethereum breaks first.

then why is verification off-chain?

a real on-chain SPHINCS- verify would cost about 300k gas per mint with the test parameters and would dominate the cost of a $6 mint. instead, our backend re-runs vitalik's python verifier, and if the signature is valid, signs a short EIP-712 attestation with a normal ECDSA key. the on-chain contract ecrecovers the attestation in ~5k gas. every (public key, SPHINCS- sig, attestation) triple is published to ipfs so anyone can independently re-verify with vitalik's python.

we are explicit about this trade-off because pretending otherwise would be a lie. if you trust the contract bytecode and the IPFS feed, you cannot be cheated of supply or rugged of fees, regardless of what the backend does.

can the backend rug me?

the backend can delay your mint by refusing to publish the next root. it cannot:

• mint to a different address — your address is inside the signed message
• mint extra supply — the contract caps public mint at 10,000,000
• change the price — MINT_PRICE is a constant in the bytecode
• steal your fee — fees are forwarded to the dev wallet on every mint, the contract holds zero ETH

what about replays?

every public key can mint exactly once. the contract stores apkUsed[pkHash] mapping. the message you sign is bound to a fixed domain tag (keccak256("sphincs-mint:v1")) plus your recipient address, so signatures cannot be reused on any other contract.

what happens at 100% mint?

when 20,000 mints have been claimed, the public mint is over forever. the 10M LP reserve gets paired with ETH on uniswap v4 (we pre-announce block number and pool fee). the 1M team reserve unlocks on a 6-month linear schedule.

where do my fees go?

0.0025 ETH per mint is forwarded to the dev wallet (0xCf28…d3F7) at the same time as your tokens are minted. there is no withdraw button, no fee escrow. if the contract is ever compromised, no ETH is held.

why "sphincs minus"?

because vitalik's repo is called sphincsminus. the "minus" is from SPHINCS−C, an optimized variant of SPHINCS+ where the C stands for "counter" (the FORS+C grinding step). we kept the lowercase, kept the dash, and let the meme do the rest.