Dusk

The First Covenant

Jun - Nov 26

Instructions that stay sealed until their condition is met
A permissionless node network, rewarded by stake
Cryptography made accessible to any developer

Covenants on the Ethereum L1

Dusk is the foundation phase for Covenants. Whereas Nillion's earlier work focused on computing over data that remains encrypted, Dusk introduces a distinct primitive: an instruction sealed to a condition, published on Ethereum, and unreadable by anyone until that condition is met. It establishes the cryptography, the node network and the developer tooling that every phase builds upon.

Condition-gated events on Ethereum L1. Nodes decrypt the result only when a live data feed shows the condition has been met. No keeper is required, and no party decides whether to act.
Permissionless nodes, rewarded according to stake. Anyone can operate a node by staking NIL, with rewards following stake. Baseline tokenomics and the node kit are released in this phase.
Agent-optimised SDK for condition-native apps. Applications are built in a few lines of TypeScript. The identity-based encryption underneath remains under the hood.

Milestones

The move to Ethereum begins. Covenants are built on Ethereum mainnet, and the network moves with them. Operators can unstake from the L2 and bridge NIL to Ethereum, with rewards paid throughout the window.
Dusk on Sepolia testnet. The full primitive on a public testnet, instructions sealed to conditions and resolved onchain with no trusted party.
The first apps go live on testnet. Applications built on Covenants, running end to end.
Dusk live on Ethereum mainnet. Contracts deployed and the node network bootstrapped, with the first applications live on L1. Node rewards begin on Ethereum from this point.
Rewards move fully to Ethereum. Emissions transfer to L1. All node rewards are paid on Ethereum from here.
The L2 retires. The bridge closes and the L2 is decommissioned. All settlement takes place on Ethereum mainnet.

Darkfall

One network across the EVM

Jun 2026 - Nov 2026

The same Covenants across every EVM chain
Native tooling on each chain
Nodes holding each other accountable

Multichain and native across the EVM ecosystem

Dusk establishes Covenants on a single chain. Darkfall extends the same primitive natively across the EVM ecosystem, so that a Covenant behaves identically wherever it is posted. One network of nodes serves every supported chain rather than a separate deployment for each, and accountability among those nodes is enforced by consensus between them rather than by any central authority.

One network, many EVM chains. All of Dusk's functionality on Arbitrum, Base, Optimism and the wider EVM ecosystem, served by a single shared node network.
Chain-specific nodes and tooling. Node operators and developers work natively on each chain, with tooling built for the environment they are in.
More node accountability through P2P communication. Nodes communicate directly with one another, so jailing and slashing are enforced by consensus among them rather than by a central referee.

Milestones

Deployment across the EVM. Arbitrum, Base, Optimism, BNB, and the rollup fleets, running the same bytecode against one shared node network. Chains carrying EIP-2537 precompiles verify reveals cheaply and are prioritised accordingly.
Canonical condition encoding. A condition encodes byte-identically on every chain. This is the property that allows a single node set to serve many chains at once.
Expanded SDKs, tooling, and wallet support. Each chain community gets native tooling rather than an Ethereum integration adapted after the fact.
Specialised node roles. The network separates into distinct node types, including dedicated feed oracles and high-frequency variants.
Peer-to-peer robustness. Gossip and consensus between nodes bring jailing and slashing under collective enforcement, strengthening the network against malicious operators.
Stake once, earn everywhere. Stake, emissions and the registry remain on Ethereum while nodes earn fees from every chain they serve. Pricing runs against each chain's own base fee, so a rollup's cost profile is not mainnet's.

Skyglow

Multichain Settlement

Dec 2026 - Mar 2027

Multichain expansion
Conditions watched on one chain, settled on another
Reveals the destination chain can verify

Multichain settlement logic, and onward to non-EVM

Darkfall replicates Covenants across chains. Skyglow makes them genuinely multichain, separating the two halves of a Covenant so that a condition observed on one chain can release a secret on another. Nothing is bridged and no message is relayed: once enough nodes have observed the condition, the reconstructed key is sufficient on its own, and the destination chain can verify that it was rebuilt honestly.

Observe on one chain, settle on another. A condition referenced on one chain releases an instruction on a different one, making a single Covenant genuinely multichain. Observation and settlement no longer have to occur in the same place.
Verifiable reconstruction at the destination. Verifiable secret sharing and cryptographic commitments allow the destination chain to confirm the key was reconstructed honestly, preventing a malicious node from forging a reveal.
Beyond EVM: Solana, Move, Monero. The multichain network extends past the EVM, with feeds monitored or settlement occurring on chains outside it.

Milestones

Cross-chain condition logic. A condition referenced on one chain releases an instruction on another. Only a key and a proof cross the boundary: no value is locked and no assets are wrapped.
Succinct settlement. A reveal can carry a proof that the destination chain verifies directly, rather than replaying the underlying shares.
Verifiable reconstruction. Verifiable secret sharing and cryptographic commitments allow the destination chain to confirm a key was reconstructed correctly, preventing a malicious node from forging a reveal.
Non-EVM deployment. Native support extends to Solana and the Move chains. Where a chain exposes different curve support, reveals are wrapped in a succinct proof rather than porting pairing verification at prohibitive cost.
Condition disbursement for chains without contracts. Monero is reached by gating the completion of an adaptor signature, the same primitive its atomic swaps already rely on.
A new paid role: the settler. Whoever produces the succinct proof and lands it on the destination chain is reimbursed like a firing node, introducing the first work the fee model prices in compute rather than gas.

Nightside

Conditions from any feed

Apr 2027 - Jun 2027

Conditions built on anything a feed can attest to
Nodes specialising in the feeds they observe
Cost that does not climb with complexity

Any provable fact becomes a condition

Through Skyglow, conditions are drawn from a fixed set of data feeds the network knows how to observe. Nightside removes that constraint. Any feed capable of attesting to a fact can form the basis of a condition, which extends Covenants beyond financial markets to any outcome that can be observed and proven.

Conditions can refer to any observable data feed. A shipment arriving or an auction closing, any fact an attested feed can establish, rather than a set chosen in advance.
New feed-specific node roles. Operators specialise in particular feeds, which is what makes capabilities such as high-frequency trigger checks possible.
Optimised conditions when feeds are numerous. BLS and FROST collapse many nodes' observations into a single aggregate attestation, so cost does not climb as the number of feeds grows.

Milestones

User-defined conditions of any complexity. Heterogeneous facts are supported, with each atomic condition compiling to an identity, leaving the underlying cryptographic core unchanged.
Aggregate decentralised attestation. BLS and FROST collapse many nodes' observations into a single aggregate attestation, which is cheaper, tolerant of failure, and doubles as the key material.
Attestation adapters for new fact types. Every new class of fact requires a source the network can observe and canonicalise identically. Building those adapters is the substance of the phase.
Expanded node capabilities. Operators can run nodes serving custom feeds, opening additional earning opportunities tied to the feeds they specialise in.
Fees that follow the fact. A flat protocol fee becomes a schedule by condition class, with chain-native facts cheapest and attested external facts priced for the work they impose.
Shared facts amortise. A single attestation serves every Covenant conditioned on it and is priced per consumer, giving the network oracle-feed economics rather than per-trigger cost.

Neon

Privacy from the network itself

Jul 2027 - Sep 2027

Errors caught before a Covenant reaches the chain
Conditions the nodes themselves cannot read
Misbehaviour that can be proven and penalised

A formal Covenants language and VM

Nightside gives Covenants their full expressive range. Neon gives them a language. A formal grammar and a hardened virtual machine raise the assurance of every Covenant the network resolves, with stronger checks before one is published and finer grained penalties after. Privacy extends a step further in the same phase: conditions become invisible to the node evaluating them.

Developer guardrails and optimisations. Stronger compile-time checks catch errors before a Covenant reaches the chain, and each Covenant becomes smaller and cheaper in the process.
Conditions fully private to nodes. In earlier phases the nodes evaluating a Covenant can read its condition. From Neon they cannot: a node can establish that a condition has been met without ever seeing what it states.
Nodes run a more hardened VM. Results are verified more strongly, and misbehaviour becomes specific enough to be slashed or disputed case by case.

Milestones

A dedicated Covenants language. Authors can nest conditions, reuse conditions and outputs through variables, perform calculations on condition parameters, and write parameterised finite loops.
An optimising compiler. Constant folding, loop unrolling and dead path elimination reduce identity layers and ciphertext bytes, lowering the gas cost of posting without any protocol change.
A hardened protocol VM. Node capabilities are consolidated into a fully defined runtime, with results verified more strongly than before.
Private conditions. In earlier phases the nodes evaluating a Covenant can read its condition. From Neon they cannot.
On-chain verification at reveal. For conditions a chain can read, settlement re-checks the condition at reveal. A false reveal does not merely lose money, it reverts, making a lie unsubmittable rather than contestable after the event.
Attestation slashing and optimistic disputes. A node publishing a decryption key for a condition the world did not satisfy is provably wrong and is slashed, with a bounty to the reporter. Subjective facts are resolved by bonded assertion with a challenge window.
Graduated trust. Each Covenant declares its regime, chain-verified, slashable-attested, or optimistically-disputed, so a single market spans mechanically checkable and subjective conditions.

Aurora

Durability against quantum attacks

Oct 2027 - Dec 2027

Sealed under two schemes at once
Attestations secure against quantum attacks
Computation over data that stays encrypted

Post-quantum hardening

Every guarantee established in the preceding phases rests on elliptic curve cryptography, which a large quantum computer would break. Aurora is about durability. Covenants are sealed under classical and quantum-resistant schemes simultaneously, so that a Covenant written today remains closed unless both are broken.

Hybrid post-quantum sealing. Each Covenant is sealed with both current cryptography and a quantum-resistant scheme. Breaking either one alone is not sufficient to open it.
Lattice threshold signatures. The attestations that power the network move to lattice-based signatures, which remain secure against quantum attack.
FHE coprocessors. Fully homomorphic encryption allows the network to compute over ciphertext while checking conditions and settling.

Milestones

Hybrid sealing. Covenants are sealed under both pairing-based and lattice cryptography, so a payload remains secure unless both are broken. This follows the migration stance already adopted in hybrid TLS key exchange.
Lattice-based identity encryption. The Boneh–Franklin core is replaced with lattice IBE in the GPV line, resting on Learning-With-Errors and aligned to NIST's finalised post-quantum standards.
Post-quantum threshold signatures. Node attestation migrates from Schnorr-based FROST to lattice-based threshold signatures, preserving the decentralised attestation model against quantum attack.
FHE coprocessors. Complex encrypted computation is offloaded to a fully homomorphic coprocessor, allowing conditions and logic to be computed over ciphertext without decryption.
Pricing by time horizon. Long-dated secrets, which are the primary harvest-now-decrypt-later targets, carry the hybrid ciphertext premium. Short-dated Covenants remain classical and inexpensive.

Moonshine

Covenants at everyday costs

Jan 2028 - Mar 2028

An order of magnitude less data onchain
Many reveals verified as one
Cost that does not grow with the network

Scaling to everyday use

By Aurora the network is complete and durable. Moonshine is about cost. Ciphertext moves to cheaper onchain storage, and the shares that open a Covenant are aggregated and proven together, reducing the cost of sealing to the point where privacy becomes a default rather than a deliberate expense.

Data volume reduced by an order of magnitude. Ciphertext is posted to EIP-4844 blobs rather than calldata, at roughly a tenth of the cost.
Aggregated, ZKP-verified reveals. The shares that open a Covenant are posted together, with a zero-knowledge proof the chain verifies in a single check.
Heavy work offloaded to coprocessors. Cost scales with the number of shares rather than the number of nodes, so growth in the network does not increase the cost of using it.

Milestones

Smaller ciphertext. Leaner range encodings and Merkle-committed identity sets reduce size, with ciphertext moving to data-availability layers rather than calldata.
Aggregated reveals. The shares that open a Covenant are posted as one, with a succinct proof of reconstruction the chain verifies in a single check instead of replaying each share.
Cheaper creation. Batching, the EIP-2537 precompiles and cheaper hash-to-curve bring the cost of sealing to a fraction of what it was at genesis.
Offloaded computation. The most expensive functions migrate to coprocessors, with assurance that the work was performed correctly.
Micro-pricing. The protocol fee is re-cut for cent-priced Covenants, and standing users can stake NIL for capacity rather than paying per Covenant, making usage an entitlement of holding.
The network begins to pay for itself. Batch settlement pays many nodes in one transaction, and the first review of the emission taper follows once fee income rivals the baseline.