The 24-Year Journey to Speso:
A Currency Priced by the World Economy

Six Lines in a Notebook

The seed of the idea goes back to 1995, but I wrote no code then. April 2002 is when it became concrete, and when I started writing code. The notebook in the banner above shows how I listed it: six points. Global currency. Peer-to-peer. Decentralized. Distributed. Deflationary. Value from global economic metrics. Then the problem I saw first: double-spend. And the shape of the data: boxes joined by arrows, with a question mark: a linked list, of sorts?

Notice what is in that list and what is not. Nothing about mining. Nothing about tokens or fundraising. The two ideas that matter are the ones everybody forgets when they say “cryptocurrency”: a money with no issuing authority, and a money whose value is anchored to something real instead of to a promise. Both are hard. The first needs a solution to double-spend. The second needs somebody to tell the chain what the world economy is doing, and that turns out to be the harder of the two. Most of this article is about that.

Why “Speso”, and Why an Integer

Speso is the Esperanto word for a spending, an expenditure. The word came much later than the idea, but it fit for a second reason: in 1907 René de Saussure (brother of the linguist, and an Esperantist) proposed a monetary unit for the world called the spesmilo, symbol ₷, pinned to 0.733 grams of gold. In his scheme the speso was the tiny base unit, “purposely made very small to avoid fractions”, and the spesmilo was 1,000 spesoj.

That is exactly what a ledger wants. Floating-point money is a classic source of bugs, so the chain stores integer spesoj only, and people deal in ₷ with up to three decimals. Saussure pinned his spesmilo to gold. This one is pinned to the world.

The Score: Pricing a Coin With the Planet

Every block carries five economic indicators, each stored as an integer number of hundredths of a percent: world GDP growth, global inflation, unemployment, trade growth and a financial stress index. From those five numbers the chain computes a single integer, the score. 10,000 means 100.00 and is the baseline.

A healthy world makes a spesmilo worth more than 1 GBU, and a sick one less. The arithmetic is integer-only on purpose: every node on the network must compute exactly the same score from the same inputs, or the chain forks. This is the entire function:

One point of GDP growth is worth +8%; a point of unemployment costs 3%; inflation is penalised in both directions around a 2% target. The weights are placeholders, and I say so in the source. They are the part you would argue about for years, and that is the point: the protocol decides how the economy is turned into a price, and the community decides the weights.

Double-Spend: The Problem I Wrote Down in 2002

Digital cash is just data, and data can be copied. If I can send you the same ₷ 10 and also send it to someone else, the money is worthless. With no bank in the middle to say which payment came first, the network itself has to agree on an order. The linked list from my doodle is how: blocks of transactions, each carrying the hash of its parent, so that changing any old block breaks every block after it.

The five defences in the code, in the order they bite:

Defence 1 is the line if (t.seq != nextSeq(from)) return false. It is the whole idea in one comparison, and it is what the 2002 notebook was reaching for. The test suite attacks it directly: a conflicting payment with the same sequence number, an exact replay, an overspend with the next number, a block that reuses a sequence number, and a block that spends 80 from a balance of 50. All are refused.

The Hard Part: Who Tells the Chain What the World Is Doing?

Double-spend is a problem the network can solve for itself, because everything it needs is on the chain. Pricing the coin from the world economy is different: GDP growth is a fact about the outside world, and no blockchain can verify a fact about the outside world. All it can do is decide whose claim to believe.

My first version let any holder publish a signed report of the five indicators, and the chain took the stake-weighted median. A block with any other numbers was invalid, so miners no longer chose the price. I wrote down the weakness honestly: the oracle proves agreement, not truth. Anyone holding a majority of the reporting stake can set the number. That sentence was the first item on my list to fix.

The fix: two keys

The change is a rule that says neither group may set the number alone. Key 1 is a fixed set of named publishers who sign attestations of the data; the candidate value is their median, and it only counts if enough of them agree (a strict majority by default). Key 2 is the stake: holders still publish reports, but now their median can only ratify or veto the publishers' value. The price moves when both keys agree, and otherwise it freezes. A veto is not free: a stake report that lands in a block and clearly contradicts the publishers' value burns 2% of the reporter's balance, and when the publishers have no consensus nobody is slashed, so a stake majority can never punish the minority.

Two design decisions are worth naming. First, it fails closed: with no publishers configured, no attestation can ever be valid and the score stays frozen at baseline. It never quietly falls back to the old stake-only oracle. Second, publishers are a role, not a bankroll: their transactions may carry a zero fee, so running a publisher costs no spesmiloj. Only the fixed publisher addresses can send them, and the list is hashed into the genesis block, so a node with a different list is on a different network and simply will not sync.

One more detail from the tests, because it shows why stake is a living thing. When I wrote the “stake majority cannot override attested data” test, it failed. The ledger was right and my test was wrong: the two holders who disagreed with the majority were the ones mining the test blocks, and their rewards grew them into the majority. Stake is dynamic. The fix was to have a non-reporting wallet mine instead. A good sign for the rule, and a reminder to read the failure before blaming the code.

Steering, Not Guaranteeing

A score on its own is only a number. Three mechanisms make it matter, and one thing is honestly out of reach.

The honest limit is the second item on my original list: the supply policy and GBU settlement steer the value but cannot force a market to honour it. No software can. A shop in another currency's economy will pay whatever it likes for a coin. What the code can do is make the protocol react: when the market values ₷ below the peg, the chain stops minting and burns fees, which is the only lever it has. It is feedback, not enforcement, and contraction is one-sided and slow: it never confiscates a balance. The CLI says so too: rate prints a “protocol reference” and reminds you that what a market pays may differ.

Deflation: what it is, and how far it goes

Deflation was in the idea from the start. It was left out of the banner and out of the first version of this article, and it is in the code. Three things make the Speso deflationary:

• A ceiling that only goes down. The supply ceiling is 21,000,000 ₷ × 100 / score and is never above 21,000,000 ₷. A stronger economy lowers it. A weaker one does not raise it: the value of a ₷ falls instead of the supply growing.
• Nothing is issued above the ceiling, and fees are destroyed. Above it no coins are minted and every fee is burned, so the supply can only shrink. Stake slashed for contradicting the publishers is burned too. rate prints the running total (“burned since genesis”).
• The price side. One ₷ is worth score / 100 GBU, so a growing economy makes each ₷ worth more GBU and the same goods cost fewer ₷.

Two limits, stated plainly. The supply barely shrinks on its own: the minimum fee is one speso, ₷ 0.001, and a score of 116 lowers the ceiling by about ₷ 2.9 million, which would take roughly 2.9 billion minimum-fee transactions to burn. In practice the ceiling works by stopping issuance, and the strong effect is on the price. And it is not perpetual: the score is built from growth rates around a baseline, so a world growing at the baseline rate sits at score 100 and the value is flat. Booms are also partly undone: when the ceiling recovers, mining resumes up to it, so coins burned below the ceiling are issued again. The older counter-cyclical rule, where a weak economy raised the ceiling, is still there behind -Dspeso.elastic=true.

Making a Prototype Behave Like It Might Be Attacked

The details are in the README, but three changes made while fixing the list are worth showing. Signatures are bound to the network. What gets signed is the network id plus the payload, so a transaction signed for a testnet is simply invalid anywhere else:

The network id is a hash of every consensus setting, including the network name and the publisher list, and it is part of the genesis block. Wallet files are created private from the start: the file is created with rw------- in the same call, instead of being written first and locked down afterwards, which leaves a window under a permissive umask. And the CLI will not start without an explicit --i-understand-unaudited flag, and on -Dspeso.network=mainnet it also refuses to start without a publisher list.

What 253 Passing Tests Do and Do Not Mean

The third item on my list was the code is unaudited and shouldn't hold anything of real value. I cannot fix that with code, and anyone who tells you their own code is audited because their own tests pass is fooling you or themselves. An audit is an independent party, with adversarial intent, reading the code. What I can do is make the code easier to audit, attack it myself, and refuse to let it be run casually.

The suite is mostly attacks, not demonstrations: stolen signatures, a tampered amount, a signature from the wrong key, a signature not bound to this network, forged blocks with overspends and reused sequence numbers, miner-chosen indicators, wrong difficulty, a lighter fork trying to replace a heavier one, a corrupted and a tampered chain file, a wrong wallet password, oversized network lines, garbage payloads, and a peer who keeps sending garbage until it is banned. For the oracle there is a test for every row of the table above except the last, which no test can cover: it is the case where the trust itself is betrayed.

Build, Test, and Start a Three-Publisher Test Network

Plain Java 17+. If there is no javac, the build script falls back to the jdk.compiler module.

A node prints its address when it starts; a publisher's address is what goes into -Dspeso.publishers. The console has send, sendgbu, quote, rate, publishers, chain, status and a few more. The feed file is five lines (gdp=3.4, inflation=2.6, and so on) and may add market=1.02 for the peg feedback. With --rpc 7100 a node serves a small JSON API, and the thin wallet Cli (no chain, no mining) signs locally against it: Cli --wallet alice.dat send <addr> 5. --auto-feed makes a node fetch the World Bank and IMF data itself and publish it.

Twenty-Four Years, and a Documentary

The idea was there in 1995. In 2002 I had a list of bullet points, one named problem and the first code. In 2026 I have about 3,000 lines of plain Java that solve the problem, a price rule that cannot be set by any single party, a feedback loop that reacts to the market without pretending to command it, and a list of things it does not do, kept as honest as the list of things it does.

I have no illusions about what a prototype with no audit and no users can threaten. But the shape of the idea (a money that no one issues, priced by the state of the whole world instead of by a single country's promise) is the one I wrote down in April 2002, and I still think it is worth building properly. The code is open. Read it, run it, break it, and tell me where it fails.