A validator seat on Paraloom costs two assets. 1 SOL and 1M PARALOOM, both locked, both slashable.
The reason is that a cheap seat and a cheap majority are the same number when you only stake one asset. Registration is permissionless and the quorum is stake-weighted, so twenty-one addresses at 1 SOL each buys twenty-one SOL worth of two thirds of the vote. One operator, and nothing on chain to tell them apart. Raise the floor and you fix it by pricing out the Raspberry Pi in someone's spare room, which is the operator we actually want.
So the two costs go on two assets. The SOL floor stays low, because the hardware bar is low on purpose. Verify-only, no GPU, a Pi 5 holds a seat. The cost of a takeover moves to the token instead, where twenty-one seats means twenty-one million PARALOOM bought on a thin market, against itself.
That only works at the token's real price, which is why the floor is a config value and not a compile-time constant. `set_min_token_stake` moves it without a redeploy, so it can be raised as the price climbs and lowered if it falls. Set wrong, it deters nothing. That is the honest limit of the design, and pretending otherwise would only move the failure somewhere harder to see.
Alongside it the pool carries a deposit cap. It is checked against the vault's live balance rather than cumulative volume, so withdrawals free the room back up. A ceiling on how much can be at risk at once, not a lifetime quota. If there is something wrong in the shielded pool that we have not found, that number is the most it can cost.
Both start closed. The cap is zero at deployment and the token floor starts at its recommended value, so a forgotten step costs a rejected deposit or a rejected registration, never an open door. Both are gated on the cold registry authority rather than the settlement key, which has to stay hot to co-sign. Compromising the key that signs settlements does not lift the loss ceiling.
That authority is one key today. The instruction surface is already shaped so it can become a governance PDA without changing a single call, and voting on treasury and on exactly these parameters is where it goes. It is a plan with the seam cut for it, not a DAO we are claiming to have.
Validators earn 0.25% of the withdrawals they settle, credited on chain to whoever did the work and claimed with `claim_rewards`. No founder cut. Not yield. Collateral at risk, paid for doing cryptographic work.
All of it ships with the trusted-setup redeploy. The ceremony chain is closing now.
Devnet, pre-mainnet. Every number above is in the program, and the program is open.