How a published figure is defined, and how you check it

1 · Versioning

Definitions are versioned and every published figure names the version it was computed under. This is the difference between a measurement and an assertion: without a version, a figure cannot be compared with the same figure published a year later, and comparing them anyway is how the existing public estimates ended up contradicting one another.

A definition change never rewrites a published figure. A figure recomputed under a new version is published as a new record that references the old one, and the old record stays readable with its old version still attached. The changelog is part of the definition, not a footnote to it.

Definitions are versioned per component, not as a single block, and every published figure names the version of each component it depends on. The endpoint definitions in section 3 and the magnitude definition in section 4 are both frozen at v1.0. Nothing is published under a component that is still a candidate — a figure computed under a definition that may still change could not be compared with the next one — so the versioning mechanism holds whether or not a component is frozen today.

2 · The unit of record

One record is one enforcement action that has taken effect: a single on-chain transaction after which one or more targets can no longer move a specific asset on a specific chain. Effect is what is counted, not intent and not announcement.

If a single transaction affects several targets it remains one record. The number of affected targets is part of the record; the targets themselves are not published, because the Bulletin is a record of actions rather than a directory of parties.

On chains where the restriction attaches to a token account rather than to a wallet, the token account is the unit. Two accounts controlled by the same wallet are two records if both are restricted, and one record if only one is — treating them as a single wallet-level event would silently double or halve counts depending on the chain.

3 · Endpoints and intervals

Both endpoints of every interval are block timestamps. Neither is an observation time, so our latency, our uptime, and our collection schedule do not enter any published figure — two readers on two different nodes get the same number, and they get it whether or not we are running. These endpoint definitions are frozen at v1.0.

Execution endpoint

The block timestamp of the transaction after which the target can no longer transfer the asset. Determined by effect on chain state, not by the name or signature of the function called.

Initiation endpoint

The block timestamp of the earliest transaction on the same chain that is a necessary precursor to the execution and names the same target. The entry publishes that transaction as precursor_tx_ref, so this endpoint is a reading anyone can take: fetch the transaction, read the timestamp of its block. Where the entry publishes no such reference, this endpoint is null.

Interval

The execution endpoint minus the initiation endpoint, reported in whole minutes, and only when both endpoints exist. Two block timestamps, two transactions named in the entry, one subtraction.

An endpoint and its reference travel together. An entry publishes an initiation endpoint only alongside the precursor transaction it is the block time of, and it publishes that reference only alongside the endpoint — the content schema rejects either one on its own, because an endpoint no reader can check is an assertion rather than a measurement. The verifier re-derives the endpoint from the reference, and checks that the precursor sits in an earlier block than the execution and carries the same target.

A null initiation endpoint is published as null. It is never dropped from the record and never read as zero: an interval that cannot be measured is a blind spot, and a blind spot recorded as zero would drag every aggregate downward while looking like better coverage. Nothing about how long an interval tends to be can be taken from this page or from the record; whatever interval exists is a by-product of how an issuer is governed, and it can go to zero without notice.

4 · Magnitude

Magnitude is the base-ten logarithm of the share of the asset’s own on-chain supply immobilised at the execution endpoint, offset onto a 0-to-10 scale and rounded to one decimal. The entire on-chain supply of an asset immobilised is 10.0; a thousandth of it is 7.0; a millionth is 4.0. Below a ten-billionth of supply, magnitude is 0.0.

M = round(max(0, 10 + log₁₀(U / T)), 1), for 0 < U ≤ T · U = units immobilised (read by freeze type, see below), T = the asset contract’s total supply on the same chain at the block that type reads

A share of supply, not a raw unit count and not a dollar figure. A unit count is not comparable between assets — decimals differ and a token count is not a value. A dollar figure needs a price at the execution timestamp from an off-chain source the reader has to trust and cannot easily reconstruct. A share of on-chain supply is dimensionless, independent of the asset’s decimals, and needs no price. On an EVM chain both U and T are historical-state reads at the execution block, so the ratio is deterministically recomputable from an archive node and nothing else. Magnitude is comparable across assets and it is not a judgement about how serious an action was. This magnitude definition is frozen at v1.0; see section 1 for how a frozen definition is revised.

The denominator T is total supply, not circulating supply — a deliberate trade-off. Total supply is a single deterministic read from chain state at the block the freeze type reads, whereas circulating supply subtracts treasury and locked balances by rules that live off chain, cannot be reconstructed from chain data alone, and so would make the figure unrecomputable. Within the EVM v1.0 domain the two rarely diverge enough to move the rounded figure — the distortion is typically under 0.1 of a magnitude point.

4.1 · The amount, where the balance cannot be read back

A blind ratio does not make the amount blind. On a chain that serves only the latest state, the balance at the execution block is rebuilt from the asset contract’s own transfer log, which is historical and indexed: every transfer that names the target is added to or subtracted from a starting point, and the balance at the execution block falls out of the arithmetic. Mints and burns need no special case, because they are transfers from and to the zero address.

Two starting points are available and they check each other, because they read different stretches of the same log and must produce the same figure. One starts at zero at the contract’s first block and adds everything up to the execution block. The other starts at the balance the node reports now, with that block pinned, and undoes the log back to the execution block. The first reads the contract’s whole history and costs thousands of queries on an endpoint that caps a log query at 5,000 blocks; the second reads only the blocks since the freeze. Either alone checks an entry.

The reconstruction stops rather than guesses. A page that cannot be read ends it, because a sum missing one page is indistinguishable from a smaller balance. So does a result below zero, and so does any event other than a transfer or an approval naming the target inside the range read — something the transfer log does not describe may have moved the balance, and the figure would no longer be provable. Where the executing transaction destroys the balance rather than immobilising it, no balance is reconstructed at all: the amount is the destroyed amount decoded from the transaction’s own event log, which is what “immobilised” means for a destroy and the only exact reading of it.

The denominator is not recoverable this way. Total supply changes for reasons a single target’s transfer history does not record, so on such a chain the entry carries the amount and a null magnitude side by side. That pairing is the honest one: it states how much was immobilised and admits that the share it represents cannot be measured here.

Boundary rules

In-place freeze. A blacklist or freeze authority that immobilises a balance without destroying it. U is the target’s balance at the end of the execution block; T is the contract’s total supply at the end of that same block. Reading both at the block’s end means two verifiers reading the same block get the same T even when a mint or burn also lands in it.

Destroy or clawback. The executing transaction burns the immobilised balance and reduces total supply in the same block, so the balance is already zero by the block’s end. U is therefore not read from end-of-block state but taken as the burned amount decoded from the execution receipt’s event logs — the issuer’s own event, which the verifier decodes under the open-source rules. T is the total supply at the end of the block immediately before execution, the supply those units were a share of. This keeps U ≤ T and the ratio defined, and it is why the read point differs by type rather than being uniform.

Anomalies are not clamped. If the arithmetic yields U > T, or T is zero, or either value cannot be read, no magnitude is emitted: the entry carries null with the reason, not 10.0. Clamping such a case to the top of the scale would dress an unreadable or contradictory measurement as a whole-supply freeze. A reading of 10.0 means the immobilised share reaches the whole supply within rounding distance — the top of the scale, not a claim that U exactly equals T.

Rounding. The offset value is rounded to one decimal, half rounding up, after the logarithm — never before. The verifier reproduces that single decimal digit for digit; a definition that did not pin the rounding mode would let two correct implementations disagree in the last place.

Magnitude is a share scale, not an absolute size. It says what fraction of one contract’s own supply on one chain was immobilised — not how many units and not how much value. Two things follow. Records are not summed across chains or contracts, because a share of one supply is not a share of another. And the figure is sensitive to the granularity of the freeze mechanism: an action expressed as many per-account entries — as on Solana, where the unit is the token account — is recorded as several records at lower individual magnitudes rather than one large one, even though the same total was immobilised. This is why every entry publishes the absolute immobilised amount next to the magnitude: the scale answers “what share”, the amount answers “how much”, and neither substitutes for the other.

On the specimen record below, vertical excursion scales with magnitude and each trace is one day. It is drawn from synthetic values and carries no real event.

5 · What is counted and what is excluded

Boundary conditions decide more of a published median than the arithmetic does. These are the ones that matter, stated in advance rather than settled case by case.

6 · Aggregation

Time figures are aggregated across issuers and across chains. No per-issuer series is published, in any study, at any level of detail. This is a standing constraint rather than a current editorial preference: a per-issuer table of intervals is an operational map, and it would be read as one.

Quarterly series use calendar quarters in UTC, and a quarter is published only once it is complete. Central tendency is reported as the median with the 25th and 75th percentiles, because the distribution is heavy-tailed and a mean on its own would be dominated by a handful of events.

The count behind every figure is shown. A slice with a count below the declared minimum is published as too small to report, not quietly omitted — an omitted slice looks like an absence of events, which is a different claim entirely.

7 · The verifier

The verifier is a standalone open-source program. It takes a record identifier and access to an archive-capable chain node — one that can serve historical state at the execution block, which the magnitude check requires — and it prints a digest. Every published record names the release tag that reproduces it, and that tag stays runnable after later releases so that old records stay checkable.

It reads nothing from us: no key, no account, no private feed, no data that exists only on our side. If our service is down, the check still runs. This is the point of the design — a verification that depends on the party being verified verifies nothing.

A reported mismatch is answered in public. If the record is wrong it is corrected as a new revision stating what changed and why, with the superseded text still readable; if the record is right, the reasoning for that is published too. Retraction is a form of publication, never a deletion.

A recomputed figure is not published the instant it is confirmed. A Bulletin entry waits at least 24 hours from the moment our recomputation is complete — not from the moment the action executed — before it is published. The cooldown gives the definitions, the digest, and the review a fixed settling period, and it is enforced by the content schema rather than left to editorial habit.

8 · Why nothing here carries a name

No page, entry, or study on this site carries a personal byline. Everything is published under the company name. This is not modesty and it is not anonymity for its own sake.

An author’s name is a request to extend trust on the strength of a reputation. This site is built so that no such request has to be made: verifiability is the substitute for attribution. If a figure is correct, the verifier says so no matter who computed it. If it is wrong, a name attached to it would not have made it right — it would only have made it harder to say so.

The practical test is simple. Nothing above asks you to believe a person. Everything above tells you which public data to fetch and what to expect when you fetch it.

9 · What this page deliberately leaves out

This page stops at the boundary between definition and siting. Definitions and verification are public because a reader needs them to check a number. How the instrument is sited — what gets watched, how sources are chosen, where the record is thin — is not published.

Two reasons, and neither of them is commercial secrecy for its own sake. Publishing the siting would change the behaviour being measured, which is a straightforward way to destroy a measurement. And it would hand an operational map to readers whose interest in it is not research.

Neither reason asks for faith. Recomputing a Bulletin entry needs the definitions above, an archive-capable chain node, and the verifier — the omitted material is not an input to that check. A research study that pools a population we do not list says so on its own page and is marked not reproducible to the count; its method still is. If you find any other published figure that cannot be checked without knowing something we have not published, that is a defect in the definitions and we would like to hear about it.