# Appendix

## BLS12-381 and the Jubjub curve

BLS12-381 is a pairing-friendly elliptic curve with an inner twisted Edwards curve (of the form $−x^2 + y^2 = 1 + dx^2y^2$) called Jubjub. Parameters for the BLS12-381 curve are taken from Bowe2017. Jubjub was designed in such a way that its base field has the same size as the group of BLS12-381, allowing for efficient curve operations inside a BLS12-381 zk-SNARK. The parameters for the Jubjub curve are taken from the Sapling specifications.

## Coin Emission Graph

This is very much a work in progress, however, our thinkings and intuition around choosing the appropriate coin emission graph can be found here.

## Why Proof of Work?

We’ve done thorough and extensive research on the merits and drawbacks of Proof of Work, Proof of Stake, and Delegated Proof of Stake systems. Ultimately the conclusion we’ve come to is that Proof of Work systems are overall more secure with much better understood attack vectors and have a better path towards being more equal and fairly decentralized. Proof of Stake systems can sometimes lead to better UI/UX with deterministic finality and sometimes faster block times, but the pros do not outweigh the cons when looking at Proof of Stake based algorithms holistically.

## Continued Reading on Benefits of Privacy

While this paper aims to simply outline the protocol and not veer into discussing merits of privacy preserving tools directly, the reader might find the following papers on the matter interesting:

- We all Have Something to Hide by Moxie
- The Case for Electronic Cash by Coincenter (with edits from Elena from Iron Fish (previously called Beanstalk))
- AML Regulations of Privacy Enabling Cryptocurrencies by Perkins Coie