Almost all money is somebody's promise. A banknote, a bank deposit, a gift card, an IOU between neighbours: in each case someone has said they will pay.
This is a derivation of the smallest object that can carry a promise, and a demonstration that the rest of money is built by combining copies of it.
Today, making money is a licensed activity, and §1 lays four charges against that: who gets the new money, who is left outside, what happens to credit when a currency dies, and who pays for the failures. The usual answers are to fix the institution, which keeps the licence, or to escape it with money fully backed by something scarce. Full backing builds something real, and it stays small, because it creates almost no money.
This takes a third route: a grammar instead of a money. One object, general enough to write fiat, a bank deposit, a bill of exchange, a stablecoin and a neighbour's word.
one object a backing B = (K, P, R, E)
K who owes
P what one unit pays
R what must be handed over alongside it
E who says a claim has not already been spent
one carrier a claim a quantity held against a backing.
Bearer: whoever holds it, owns it.
one holding a wallet a set of claims, plus any bare assets
the law nothing you owe (your written maximum) grows
without your signature.
nothing you hold leaves without your signature.
asymmetry what must accompany a claim is fixed when the backing
is signed. what it pays may move with time.
The four fields are derived in three steps, and each step answers a failure in the one before. Where the text picks between options rather than following a forced step, it says so.
The object spans the two questions that sort money: reputation or collateral behind the promise, and one hand or many running it. A wallet holds positions at several points at once and moves between them as trust grows in one place and dies in another. Every move is a trade. Move toward collateral and you buy trustlessness, paying in elasticity and liquidity. Move toward reputation and you buy money creation, paying in cyclicality. Move toward a single operator and you buy convenience, paying in that operator's failure modes. The holder decides what they value and where the risk sits.
Out of the object and the law come some of what merchant law took five centuries to find, plus banks, market makers, credit ratings, derivatives and a private lender of last resort. Each appears as a role anyone can take, rather than a licence somebody has to grant. What does not appear is anything needing a judgement made after the fact, and §18 lists what that leaves out.
The design substitutes pricing for enforcement. It makes promises readable and continuously repriced. It does nothing to make them kept.
Concentration will still happen, and large backers and banks will grow back. What goes is the legal moat. A village, a supply chain or a trade association could run its own money alongside the established one. The transparent reference implementation is being built toward that goal.
Most readers arrive holding a position, and nearly all of them sit somewhere inside this object.
| If you come from | You get | Where |
|---|---|---|
| Credit theory (Innes, Graeber, chartalism) | money is credit, made to work | §4, §17 |
| Hard money | your asset as the thing hardness is measured against, and where value runs in a panic without leaving the system | §10 |
| Free banking (Hayek, Selgin, White) | the same programme, without appraising each issuer's structure by hand | §15 |
| Riegel and enterprise money | a business's own promise as money | Appendix B |
| Mutual credit and community currencies (WIR, Sardex) | the boundary object | Appendix B |
| DeFi | the collateral-heavy corner, useful and small | Appendix B, §18 |
| Cypherpunks | Chaum's design made composable, with the issuer generalised. His portfolio money is one setting | §14, Appendix B |
| Gesellians | demurrage, money that decays to push spending, as one payout setting | §5 |
The paper is the argument. Construction and Extensions are the Medium of Exchange Protocol — the normative part, and what an implementation tracks.
| Money from First Principles | The paper. Why, the derivation, the law, what emerges, and the limits. Stands alone. §17 and Appendix B locate every money you already know inside the object. There is a glossary at the end. |
| Construction | The protocol. Reference card, invariants, claim layer, sequencing, dishonour, threat model, build order, and every alternative refused. For building it. |
| Extensions | Optional profiles on top of the core — triggers, pro-rata, references, unitload, cross-operator presentation — and the claim-layer profiles that replace the pool: transparent, accumulator, Chaumian, offline. Each with the need that summons it and the price it charges. |
| Pool v1 | The core construction bit for bit, moe/pool/v1: fields, hashes, notes, the three statements, the note tree, the spent set, the history, what E names. For two implementations to agree. |
The core's claim layer is the shielded pool (Construction §C1): ownership, amounts and histories hidden, supply proven at the pool's lit boundary. The transparent ledger, the accumulator and Chaumian signatures are Extensions profiles.
The protocol has one reference implementation, and it is experimental. Its production path is the core's shielded pool, built rule by rule from Construction; its earlier transparent path is kept as a differential oracle and a library of adversarial cases while the pool is built.
| reference-ts | TypeScript. Canonical encoding, signatures, commitments and their directory, sequencing, presentation, dishonour, succession and recovery, with one test file per invariant; a real-proof experiment for the shielded pool; a frozen transparent path as oracle. |
The package is not published to npm. With Node.js 20 or newer:
git clone https://github.com/mediumofexchange/reference-ts.git
cd reference-ts
npm ci
npm run checkThe optional local pilot
runs the transparent path across two processes with a local, trusted witness
(npm run pilot:demo, Node.js 24); it is an integration harness, not a
product. The private-payment experiment
is the executable feasibility check for the shielded pool, with real proofs.
The API and wire format remain experimental; the implementation has not
undergone a completed security audit.
Three, because they do three different jobs and change at different rates.
- Money from First Principles is the paper, and keeps its name. An argument is cited, not versioned.
- The Medium of Exchange Protocol is what Construction and Extensions define: the object, the law, and the machinery around them. This is the thing that gets built.
- mediumofexchange.org is the front door,
with the org and the
@mediumofexchangenpm scope behind it.
CC0 1.0 Universal — public domain dedication. No permission needed, for anything, ever. If you build a money on this, you owe nobody here a thing.