A currency whose supply is decided every day by the people who hold it.
Timpal is built on Base, Ethereum's leading Layer-2 network. No company. No founder calling the shots. No authority above the people who hold it. Every day, the community itself votes to mint the day's batch — or burn it out of existence. Burning is the default: silence burns, ties burn. Minting has to be actively won.
More now, or less, forever.
Each day, one choice faces everyone together. Mint — and everyone who votes receives more tokens, while the supply grows. Or Burn — no one is paid, the day's tokens are destroyed forever, and everything everyone holds becomes scarcer. The people who hold it decide, out loud, on-chain, with real stakes on the table.
And the amount on the table shrinks over time. Timpal runs on a halving schedule — the daily batch is cut in half era after era, so the tokens available to mint only ever get rarer. The community controls the daily choice; the halving guarantees the supply pressure tightens on its own, year after year. Two forces, both pulling toward scarcity.
There is no owner who can mint at will. No admin who can rewrite the rules. No insider wallet waiting to dump on everyone else. What's deployed is permanent and beyond anyone's control — including its creators. The only force that moves Timpal is the will of the people holding it, one wallet, one vote, every single day.
That's what makes Timpal a movement instead of a product. You don't watch it from the outside — you're inside it, helping steer it. Burning is the default, so the quiet pressure always pulls toward scarcity. But how tight the supply gets, and how far this goes, is written by the people who show up, one day at a time. The result is a shared monument, built in public, owned by no one and everyone.
This is a token with no gatekeepers and no insiders — just a community, deciding together, every day, what it becomes.
Every burn is forever, and you can watch it happen.
When a day burns, that batch is sent to a dead address no one can ever touch — gone from supply, permanently, on-chain, for anyone to verify. It's not a promise to be deflationary. It's deflation you can see accumulate, day by day.
Four things that make Timpal different.
Supply tightens unless the community votes otherwise
Every quiet day, every tied day, supply shrinks. On top of that, the daily batch halves every era — emission only ever slows. The whole system leans toward fewer tokens over time, by design, not by hope.
Holders who vote on a mint day share the batch
You're not a passive bag-holder. On a mint day, every wallet that voted — either side — splits the freshly minted batch in proportion to its balance at the close. Hold, show up, earn. On a burn day, your existing stake just got scarcer. Either way the engaged holder wins.
No owner, no mint button, no upgrade
There's no team wallet that can mint and dump, no admin key, no contract upgrade to change the rules later. The liquidity is locked forever — the pool position was sent to a dead address, so no one can ever pull it. What's deployed is what exists, forever. For anyone who's been burned by a rug, that trustlessness is the value.
One wallet, one vote — you steer it
No foundation decides emissions behind closed doors. Every eligible holder gets exactly one vote per day to push the supply tighter or wider. You don't just hold Timpal — you help decide what it becomes.
The biggest batches are now. The curve only steepens.
Era 1 has the largest daily batches and the highest stakes — and the emission curve only halves from here, era after era, toward a tiny permanent tail. Being early to a fixed, halving, burn-by-default supply means being early to its loosest point, before the scarcity compounds. Everything that happens next is decided one day, one vote at a time.
One round a day. Four things you can do.
Timpal runs in 24-hour rounds aligned to 00:00 UTC. Everything is permissionless — there's no operator, no keeper you depend on, no privileged account anywhere.
Vote
During a round, any wallet holding the era's minimum balance casts one vote — MINT or BURN. One vote per wallet per round, with a rolling 24-hour cooldown. Casting a vote also quietly settles yesterday's round, so the system keeps itself moving.
The round closes
At 00:00 UTC the round ends. If MINT votes strictly outnumber BURN, the day mints. Otherwise — a tie, or no votes at all — the whole batch burns. Burn is the resting state; minting is the exception that has to be earned.
Settlement
Anyone can settle a closed round; it's free to trigger and bounded in cost. High-turnout days settle in batches so no single transaction ever gets too large. Settlement reads each voter's balance at the close — a fixed point in the past.
Claim
On a mint day, every wallet that voted shares the batch in proportion to its balance at the close — both sides of the vote earn. Rewards are freshly minted when you claim, never taken from a premine, and they never expire.
The batch halves on a fixed schedule.
The day's batch starts at 10,240 tokens and halves every 1,460 rounds across 13 eras, settling into a permanent 1.25-per-day tail. There is no maximum supply — what actually exists depends entirely on how the votes land over time. See the full table on the Schedule page.
Thirteen halvings, then a permanent tail.
Emission runs in eras of 1,460 rounds (≈4 years each). The daily batch halves at every era boundary — 10,240 = 2¹⁰ × 10, so every halving is exact, with no rounding drift. After thirteen eras the emission settles into a permanent 1.25-per-day tail that continues forever.
| Era | Rounds | Daily batch | Max mintable in era | Min to vote |
|---|
“Max mintable in era” is the ceiling — the most that era could ever mint, if every round in it voted MINT. In practice it is always less, because burn is the default: silence burns, ties burn.
The ceiling is known. The real number never can be.
If the community minted every single day across all thirteen finite eras, the absolute most that could ever be created from them is 29,897,150 TIMP — and Era 1 alone accounts for roughly half of it. But that ceiling assumes something that won't happen: a MINT vote every day for ~52 years straight.
Two things make a fixed “max supply” impossible to state honestly:
Every burn is permanent and unknowable in advance
Each BURN day destroys that day's batch forever. Nobody can know, years ahead, how the daily votes will land — so nobody can predict how much will be burned. Real supply is whatever's left after decades of community decisions, with burn as the default pulling it down.
A permanent 1.25/day floor, forever
After Era 13, emission never stops — it settles to a tiny 1.25 tokens per day (~456/year) with no end. It's negligible against the early eras, but it means there is no final, fixed total. The protocol keeps breathing forever.
So instead of a printed “max supply,” Timpal gives you something more honest: a known mint ceiling from the eras, an unknowable burn floor pushing supply down, and a structural bias toward scarcity baked into the rules — not promised, enforced.
Tested hard, then locked forever.
The contracts are immutable and ownerless — once deployed, they can never be changed, paused, or upgraded by anyone, including us. That permanence is the point, and it raises the bar: the code had to be right before it was locked. This page lays out exactly what was tested and reviewed, so you can judge the evidence yourself.
Every number above is a real artifact of the testing process, not a projection. Below is what each layer actually covered.
- 312 passing tests at solc 0.8.24
- Correctness, era/halving, and scale tests
- Adversarial batteries: reentrancy, flash-loan defense, timing & boundary attacks
- A differential reward oracle: an independent re-implementation of the reward math, agreeing with the contract to the wei
- Randomized multi-round simulations
- Foundry stateful invariant harness
- Eight core invariants checked after every action
- 1,000,000 random calls per invariant — zero failures
- Supply conservation held exact to the wei: total supply only ever equals premine + what the protocol minted
- Random sequences of vote, settle, crank, claim, transfer and time-warp
- Two independent developer reviews of the code and tests
- Six batches of adversarial attack ideas — no contract vulnerability found
- Static analysis (Slither, SolidityScan)
- Multiple AI adversarial passes
- Two real bugs were found and fixed earlier in development; both are closed
Every category above maps to tests in the public suite — 312 passing tests in total, plus a 1,000,000-operation invariant fuzzing run. The contracts are verified on Basescan; clone the source and run the full suite yourself.
- No owner, no admin, no proxy, no upgrade path
- The minter is frozen to the protocol at setup and can never be changed
- Nobody can mint outside the protocol's rules
- Nobody can drain the dead-address burn
- Nobody can force a round's outcome away from the true vote
- Nobody can steal, redirect, or double-claim another voter's reward
Both contracts are verified on Basescan: the published source is confirmed to match the deployed bytecode exactly, so anyone can verify it independently. The code is immutable: it cannot be changed, paused, or upgraded by anyone, including us. The Uniswap pool holds the trading liquidity and can be inspected directly on-chain.
If you open the contract source on Basescan, you may see a notice flagging two known Solidity 0.8.24 compiler bugs — UnsoundSpillInMutualRecursion and LostStorageArrayWriteOnSlotOverflow. This notice appears automatically on every contract compiled with 0.8.24; it is a generic advisory, not a finding specific to Timpal. Neither bug can affect this code: the first requires inline assembly, which these contracts do not use, and the second requires a storage array large enough to overflow a storage slot, which does not exist here. The source is public and verified — this can be confirmed directly.
The liquidity is permanently locked.
The liquidity position for the TIMP / WETH pool was a Uniswap v3 NFT. That NFT has been sent to the dead address — permanently and irreversibly. No one, including us, can ever withdraw the liquidity, migrate it, or pull it. It is locked forever, and you can verify it on-chain: the position NFT is now owned by the dead address, and the transaction that put it there is public.
Anyone can confirm this: open the transaction above and see the position NFT transferred from the liquidity wallet to 0x000000000000000000000000000000000000dEaD, a dead address whose contents can never be moved.
A currency with no masters.
What Timpal is, how it works, and why its future belongs to the people who hold it — stated plainly, and verifiable on-chain.
What Timpal is
Timpal is a currency whose future is decided by the people who hold it.
There is no team that controls it, no insider who can tilt it, no admin key to change the rules, and no owner who can be pressured, bought, or coerced. What is deployed is what exists — permanently. From the moment it launched, Timpal has belonged to the people who hold it, and to no one else.
Most money is governed by someone. A central authority sets policy. A company controls the treasury. A founder writes a schedule that everyone else must live inside. Even where the code is open, the power usually is not — there is almost always a hand on the lever.
Timpal removes the hand entirely.
Its supply is not fixed by a founder, and it is not dictated by a team. It is decided by the people who hold it, one day at a time. Every day, holders vote on that day's batch of tokens: mint it, or burn it. Mint, and the supply grows and the batch is shared among the voters. Burn, and it is gone forever — sent to a dead address, on-chain for anyone to see. Burning is the default: if burn wins, if the vote ties, or if no one votes at all, the batch burns. Scarcity is what happens when no one reaches for more.
You do not simply hold Timpal. You are a co-owner of the currency itself, with a standing say in what it becomes. Its future is not a roadmap. It is the sum of every choice its holders make, recorded in public, owned by everyone and controlled by no one.
This is what Timpal is: money placed fully in the hands of the people who use it, to make of it what they will.
The daily vote
Timpal runs in rounds. Each round is exactly 24 hours, aligned to 00:00 UTC. When a round closes, the next begins; there is no gap and no operator to start it.
During a round, any eligible wallet may cast a single vote on that day's batch of new tokens:
- MINT — create the batch and distribute it to the wallets that voted.
- BURN — send the batch to a dead address, removing it from supply permanently.
The vote is one wallet, one vote. A wallet's influence over the decision does not scale with how many tokens it holds. A large holder and a small holder each cast exactly one vote. The decision of what happens to the money is democratic, not plutocratic.
If MINT receives more votes than BURN, the round mints.
In every other case — BURN wins, the vote ties, or no one votes — the round burns.
Burn is the default. Apathy burns. Deadlock burns. Silence burns. The money grows only when a majority of participating wallets actively choose to grow it; otherwise it contracts. The pressure of the system always points toward scarcity, and expansion requires a deliberate, collective act.
How a round is decided and settled
Timpal has no operator, so the protocol must run itself. It does, through three permissionless actions that anyone can call.
Voting. During the open round, eligible wallets vote MINT or BURN. Each wallet may vote once per round, and a rolling cooldown prevents a single wallet from voting again before a full day has passed.
Settling. After a round closes at 00:00 UTC, it must be finalized. Anyone can do this — it requires no permission and no privileged role. Settling reads the round's votes, applies the outcome rule, and either mints the batch to voters or burns it to the dead address. Because it is permissionless, the protocol advances whether or not any particular person is watching; the community keeps it running by showing up.
Claiming. On a round that minted, each wallet that voted is entitled to a share of the batch. That share is not pushed automatically — the holder claims it. Supply rises only at the moment a winner claims. Tokens that are never claimed are never minted.
This claim-gated design means the circulating supply reflects real, deliberate participation. Nothing is created speculatively or in advance; the supply moves only as fast as people actually act on it.
How rewards are calculated
When a round mints, the batch is divided among the wallets that voted in that round, in proportion to each wallet's balance at the exact moment the round closed — the 00:00 UTC boundary.
Every voter is rewarded — not only the winning side. On a round where mint wins, the batch is shared among everyone who voted that round, regardless of which way they voted. A wallet that voted to burn and was outvoted still receives its full pro-rata share of the minted batch, exactly like a wallet that voted to mint. The reward is earned by participating, not by voting the winning way. This is written into the contract.
Rewards are proportional to holdings at the boundary. The decision to mint or burn is one-wallet-one-vote and ignores balance. But once the holders have decided to mint, the newly created tokens are shared according to how much each voter held at the close. Holding more earns a larger share of a MINT round — but it buys no additional power over whether the round mints in the first place.
The measurement is a fixed point in time. A voter's share is based on their balance precisely at 00:00 UTC, read from an immutable on-chain checkpoint. It cannot be gamed by moving tokens after the round closes. Every holder's balance is checkpointed automatically, with no action required on their part.
Rewards are distributed using exact on-chain arithmetic. The system never creates more than the batch; any indivisible remainder is simply left uncreated. Supply can never exceed what the rules permit.
Emission: predictable in size, undecided in direction
The size of each day's batch follows a fixed, public schedule set in the contract. The direction — whether that batch is minted or burned — is what the holders decide each day.
Issuance follows a halving schedule across a series of finite eras, after which it settles into a small, perpetual tail that never fully stops. The batch size is largest in the earliest era and halves era over era, so the potential for new supply is front-loaded and then diminishes toward a long, thin, unending emission.
This separation is deliberate. No one — not a holder, not the original deployer, not any future participant — can change how large a batch is on a given day. That is fixed forever. What remains open, permanently, is the only question that matters: on each of those days, does the supply grow or shrink? That question is never closed, and it is never answered by anyone but the holders.
A one-time genesis premine of 50,000 tokens was created at deployment. Its sole purpose is to seed the market's initial liquidity. It is not, and can never be, a source of rewards.
Ownerless by construction
Timpal's independence is not a promise. It is a property of the deployed code, verifiable by anyone.
- No owner. The contracts have no owner role, no administrative privileges, and no privileged setter. There is no account that can alter behavior, redirect funds, or change the rules.
- No mint authority in human hands. The power to create tokens is held by the protocol contract alone, and only through the daily settlement path. It was set exactly once, at deployment, and then frozen so that it can never be changed. There is no human mint function.
- The deployer is gone. The address that deployed and wired the contracts renounced itself to the zero address in the same action that froze the mint authority. The keys that set Timpal in motion hold no power over it now.
- No pause, no upgrade. The contracts cannot be paused, halted, or upgraded. What is deployed is final. The rules you read today are the rules forever.
- Liquidity locked forever. The pool's liquidity position was sent to a dead address, permanently and irreversibly. No one — including us — can withdraw, migrate, or pull the liquidity. It is verifiable on-chain.
Because there is no lever and no one holding it, Timpal cannot be rug-pulled by its creators, cannot have its supply seized or inflated by an insider, and cannot have its rules rewritten after the fact. The absence of control is the guarantee.
The website is only a convenient front door. The protocol lives on-chain, verified and public, and continues to function — vote, settle, and claim — whether the site is online or not. Nothing about participating in Timpal depends on us.
Transfers are free and unrestricted
Timpal is an ordinary transferable token in every respect that matters to a holder. There is no blacklist, no allowlist, no transfer tax, no trading cooldown on transfers, and no mechanism by which any address can be blocked from sending or receiving. Every wallet can send and receive freely, and every holder can sell at any time.
Timpal does disable one specific, non-essential feature: manual vote-delegation. In a standard governance token, a holder can assign their voting weight to another address. Timpal deliberately turns this off, because a voter's reward is tied to their own balance at the round boundary, and allowing delegation would let voting power diverge from actual holdings in ways that break the reward math. Every account is automatically self-associated for the purpose of the daily vote, so this changes nothing about a holder's ability to vote, hold, transfer, or sell. It affects only the unused ability to hand one's vote to someone else.
This distinction matters because automated security scanners sometimes misread a disabled-by-design function as a restriction on transfers. It is not. The transfer path itself imposes no limits of any kind, and this can be confirmed directly in the verified source.
The choice is yours, every day
Timpal does not tell its holders what to do. It hands them the decision and steps back.
Every day, two camps meet at the same table. On one side, those who want to mint — to grow the supply, to be rewarded for showing up, to expand what the currency is. On the other, those who want to burn — to tighten it, to make what remains scarcer and harder-won. Neither the team nor the code takes a side, because there is no team, and the code only counts the votes.
And there is a twist written into the rules that shapes how the fight plays out: on a round where mint wins, everyone who voted shares the reward — even those who voted to burn. You are rewarded for showing up and taking part, not for picking the winning side. A holder can vote to tighten the supply, be outvoted, and still receive their share of what the holders chose to create. Participation itself is what earns — which means there is always a reason to show up and cast your vote, whichever way you believe.
This is the living heart of Timpal: an open, daily contest over the fate of the money, decided by whoever shows up and how they choose. Some days scarcity will win. Some days growth will. The balance between them is not set by a founder's schedule or an algorithm's guess — it is fought for, in the open, one round at a time, by the people who hold the currency. That contest never ends, and no one can end it. That is the point.
What Timpal becomes is genuinely unwritten. It is not promised, projected, or guaranteed — and like any currency with a live market, its value can rise, fall, or reach zero. Timpal makes only one commitment: that the decision, and everything that follows from it, belongs entirely to the people who show up to make it.
Contracts and participation
Timpal runs on Base. All contracts are verified on Basescan; the published source matches the deployed bytecode exactly, and anyone can read it.
To participate, hold TIMP and vote in the daily round — through the app on this site, or directly against the contract on-chain. Every day, the choice is the same, and it is yours: grow the supply, or make it scarcer. Timpal is what its holders decide it will be.
Timpal doesn't need this website to work.
This site is just a convenient front door. The protocol itself lives on Base, verified and public, and runs whether this site is online or not. If it ever goes down, gets taken offline, or stops being maintained, anyone can still vote, settle, and claim — directly through the contract on Basescan. Nothing here depends on us.
What you'll need
A wallet (e.g. MetaMask) connected to Base, holding enough TIMP to meet the era's minimum to vote, plus a little ETH for gas. Everything below happens on the verified contract — no app, no middleman.
First time? Start here
1. Tap Open on Basescan ↗ above — that page is the contract.
2. On it, choose the Contract tab, then Write Contract.
3. Click Connect to Web3 and approve the pop-up in your wallet. (Easiest on a phone using your wallet app's built-in browser, or on a desktop with the wallet extension installed.) Once it shows your address connected, you're ready for the everyday actions below. To just look at the numbers without a wallet, use Read Contract instead — covered at the bottom.
Cast a vote — vote(bool mintVote)
In Write Contract, find vote and expand it. In the box, type the word true to vote MINT, or false to vote BURN — exactly that word, lowercase — then click Write and confirm in your wallet. The contract enforces the rules itself: you need the era's minimum balance, one vote per round, and the rolling 24-hour cooldown. If you're not eligible, the transaction simply reverts — nothing is lost but the gas.
Claim a reward — claim(uint256 roundId)
For a settled MINT round you voted in, find claim, enter that round's number, and Write to mint your pro-rata share straight to your wallet. You can claim any time — rewards never expire. To find your round numbers, use the Read Contract tab (no wallet needed): currentRound() tells you today's round, and pendingReward(roundId, address) — paste your own wallet address — shows what a given round owes you.
Most holders never need this. Settling is open to anyone, so it gets done — but if you want to be the one who advances a closed round, here's how.
Settle a closed round — settleDue()
After a round closes at 00:00 UTC, anyone can finalize it. Call settleDue (no inputs) to decide the outcome of the oldest unsettled round and advance the protocol. This is permissionless by design — it's how Timpal keeps running without any operator. For a high-turnout MINT round that needs more than one step, call crank(roundId, steps) repeatedly until it's fully settled (use a large steps value like 200).
You can verify everything yourself
The Read Contract tab exposes the full live state with no wallet needed: currentRound(), rounds(id) for a round's votes and outcome, voterCount(id), boundaryOf(id) for when a round closes, nextRoundToSettle(), and pendingReward(id, address). Every number this website shows comes from these same public reads — so anyone can verify it directly.
This is the whole point
An ownerless, immutable protocol means there's no one who can stop you from using it — including us. The website can disappear and Timpal keeps running, decided by whoever shows up to vote, settle, and claim. That's what "no gatekeepers" actually means in practice.
Vote on today's round.
Connect a wallet on Base to cast your vote and claim rewards from settled mint days. Reading the round is open to everyone; voting and claiming need a connected wallet.
This interface points at the live Base mainnet deployment. The contracts are immutable, ownerless, and verified on Basescan.