ink & Citadel

ink — Putting Pen To Paper

A web3-based public index consisting of content hashes that can be linked together to form explicit graphs of communication (original posts, references, and responses) and the protocol needed to add to and read from the index, with a simple economic mechanism to discourage adding low quality content.

Citadel — A Place For Better Discourse

A native web3 social network built on top of the Ink protocol & index that gives users tools for [reading, digesting, publishing, endorsing, responding to] [articles, opinions, works-of-all-kinds] in a format that is designed to promote more meaningful and trustworthy proliferation of information.

This is a living document. Last updated on 11/7/17.

1. Problem

Disinformation (Fake News)

Although the internet has exponentially increased the proliferation of valuable and reliable news, it has concurrently allowed for the viral spread of disinformation: false information spread deliberately to deceive.[1] Bad actors spread disinformation in many ways: through official channels such as government agencies, through unethical news sites, sites that disguise themselves as legitimate, or by creating inauthentic social media presences.[2] Most notably, the investigations into the 2016 US General Election are revealing the alarming extent to which bad actors manipulated social networks in order to impact election results.[3]

Echo Chambers & Algorithmic Bias

While the existence of multiple social networks and publishing platforms is undeniably good, the divisions between these networks can turn them into echo chambers. In some ways, the existence of echo chambers is impossible to prevent. People will naturally gravitate towards those with similar opinions.[4]

However, the extreme nature of today’s social media echo chambers is not inevitable. It is in large part a result of algorithms that are designed not to benefit the user, but to benefit advertisers. Web 2.0 social networks survive by maximizing their capture of users’ attention (to make their ad spaces valuable), which often leads them to show users content that conforms to, rather than challenges, their existing opinions.[5] Or, if an opposing idea is presented, it is in the context of outrage.

More specifically, the intense echo chambers we see on social media are caused by the fact that a social network is motivated to restrict competition against its specific set of algorithms. This lack of competition is dangerous for the evolution of discourse.

Toxic Discourse

When using public social networks (i.e. Twitter, Reddit, public Facebook groups) even if a source article or post is of high quality, the discussion of the post is often low quality. The “comments section” may devolve into a place of personal attacks and mob mentality that is counterproductive to any progress on the topic.

Trolls may invade discussions simply to provoke reactions and upset others, contributing nothing of substance and making the discussion a less welcoming place for those who do wish to interact meaningfully.[6]

Bots may spam massive amounts of low quality content as a form of native advertising or outright propaganda. In the wake of the Brexit vote of 2016 it has been determined that a bot army of 13,493 Twitter accounts assisted in the dissemination of ‘hyperpartisan news’.[7]

At this stage it would be arrogant to suggest that we could eliminate these issues entirely, but if we identify the source it may be possible to reduce their impact without compromising our anti-censorship stance.

Censorship of Ideas

Today, discussions on the internet can be censored by various actors across all strata. Censorship can be committed by an authoritarian government silencing dissent,[8] a social network trying to change its atmosphere to appease advertisers,[9] or individuals who delete posts that generate a negative response.

Whatever the intention, censorship leads to information loss. If a user deletes a post that is part of a conversation, that conversation becomes harder (if not impossible) to understand. Think of how many times we see screenshots of a tweet rather than an embedded tweet because we worry the original poster will delete it? Having to rely on a screenshot of a post hinders our ability to analyze and participate in discussions (how do we know that screenshot is even real?)

We believe that there are better solutions to the problems that cause social networks and users to desire tools for censorship.

Related Readings:










2. Cause

Economic Model

Web 2.0 social networks are inherently vulnerable to these types of failures due to their economic model. Such platforms (Facebook, Twitter, etc.) rely on advertising (in conjunction with the sale of user’s personal data) to fund server costs, development, and vast marketing teams.

In order to sell user data and perform targeted advertising, web 2.0 social networks must collect immense amounts of private information. Even if they do not track personally identifiable information, they still are able to place users into groups and target them with specific content designed to shape their habits and desires.

The need to increase time-on-site and collect/protect private information in order to profit from it leads Web 2.0 social networks to make decisions that reduce the value of their services as a tool for discussions, even if you don’t consider the act of collecting that private information itself to be invasive (which we do).


Web 2.0 social networks must be centralized in order to maintain control over the private information they collect. This centralization allows them to develop their own censorship plans, which may be designed according to the biases of the company and often have paradoxical outcomes,[1] as we will discuss later.

The relationship between social networks and advertisers causes networks to rigidly control the way in which users interact with their platforms. Networks are unable to allow for experimentation in the way content is presented to the user if there is any risk of negatively impacting advertising revenue. Energy is spent to suppress tools that could enhance the user experience (e.g. ad-blockers[2]) because their economic model is not equipped for such tools. This is nothing new- many industries experience the phenomenon of stifling innovation to secure the profits of the status quo.

The need to keep users engaged with their platforms for longer and more frequent sessions leads social networks to implement psychologically manipulative designs.[3] Most social networks employ cognitive bias exploits such as “variable reward conditioning”- the precise technique that makes slot machines so dangerously addictive.

Related Readings:




3. Solution

With Web 3.0 technologies and a new economic model, we can create successful social networks that are designed to align with the goals and values of the user.

Decentralize — The Swarm and The Chain

Emerging web3 technologies give us the opportunity to develop an ecosystem for social networks that is both immune to censorship and radically open to experimentation. We use The Swarm as a distributed storage system and the Ethereum blockchain as a distributed database. These are the twin pillars of the ink index.

We publish content to The Swarm and store the hash of that content in a smart-contract index. This ensures that anyone can freely validate that a piece of content was published in an exact state at an exact time by a specific entity. In this way we eliminate the possibility of censorship or information loss of any kind. It will always be possible to natively link to another post registered on the ink index, or to register a piece of Swarm content onto the index in order to preserve it. Users need not rely on a “hacky” solution like taking a screenshot of a post.

The index will support revision of posts so that misspellings and small errors can be fixed, and posts can be updated with new information, but the revision history is always available.

In addition to preventing censorship, the immutability of the index will naturally cause users to more carefully consider their posts, especially if they are posting from an account associated with their “real life” identity. If a user posts something they later come to regret, they will be motivated to reconcile their ideas (issue an apology, retraction, etc.) rather than ignore them by deleting the post. We believe this is healthier behavior to encourage, and cultivates a less toxic atmosphere.

A New Deal

Of course, knowing the index is immutable will not prevent everyone from posting without deliberation and it certainly will not stop trolls or bots that operate anonymously. In order to reduce the amount of low quality content without discouraging thoughtful posts (in other words, to reduce noise without reducing signal) we will add a small amount of economic friction to the act of posting.

This economic friction will be payable in the form of a fee payable in our INK token or ETH, (tokens are more thoroughly addressed later in this paper). This friction will motivate users to be deliberate in their contributions, reduce the prevalence of trolls, and make ad-spamming bots prohibitively expensive.

There have long been forums that require paid memberships. Because of this economic friction these forums tend to be of higher quality, however the friction associated with signing up (creating an account, entering credit card information, paying a large fee upfront or monthly) prevents them from achieving a high adoption rate. With nascent web3 tools like easily accessible ETH wallets, we can eliminate these large points of friction. Users will browse with immediate access to their ETH, and no need to create a new account on each DApp.

To be clear, we do not intend for our fee to be substantial enough to prohibit the self-expression of financially constrained users. The fee will be low (currently our estimate sits at $0.10 USD) and serves to remind users (human, bot, or group) to consider the value of their post. If a user posts something belligerent in haste, they may reconsider when confronted with the price of their submission. This gut check allows the user to take a step back and rework their ideas into a more constructive contribution, or simply walk away from the device for a little bit!

In addition to increasing the signal to noise ratio, this economic friction allows us to upend the attention economy model favored by current social networks. The revenue raised via the fee will cover development costs, thus we can forego any relationship with advertisers that could motivate manipulative design decisions.

Since our fee covers the cost of development and Swarm hosting, we can forego any relationship with advertisers that would incentivize us to make a product that doesn’t align with the desires of the user or our core values.

New Tools for Trust — Link, Respond, Endorse, Flag, Request

While economic friction could reduce the ability of disinformation campaigns to spread their false stories via bots, it would not be enough to stop the impact of ‘fake news’. In order to combat disinformation directly, we will create new tools that allow users to process and analyze posts.

Note: while some of these tools are built into the ink protocol, others exist on the Citadel layer. This ecosystem is discussed in more detail later in this paper.

The ability to natively link to any piece of content with the knowledge that it will never be deleted allows users to rely on direct references of posts, rather than a screenshot or ‘copy-pasted’ piece of text. With easy-to-use tools for referencing other posts, users will come to expect trustworthy references and challenge posts without them. Diligent referencing will allow users to trace quotes or claims back to their source, to verify and view them in the context of the rest of the discussion.

Individual claims, sentences, or images within a larger post can be referenced and responded to directly, creating a much more fluid and productive discussion than what results when users may only comment at the very end of a post.

Users (be they individuals, organizations, or bots) will not only be able to post content, but may review, endorse, flag, and score posts and users. In this way, our userbase is able to better decide whether or not they trust a post based on these endorsements.

For example, a user sees a post that makes an extraordinary claim about a politician. However, they immediately notice that a news organization they trust has marked the post as “disinformation”. Armed with this extra information, they more carefully scrutinize the post and realize that the references are low quality and do not support the claim. The disinformation attempt has failed.

Lastly, we are creating a system in which users can request that other users respond to a post or perform a task related to a post or claim within. The user can attach a bounty to that request, thus motivating the respondent.

For instance, a user might read a whitepaper from an organization representing a new decentralized project. The user likes the project but is confused about a part of it. They ask a question by referencing the claim that confuses them, but the paper is so popular that their question initially gets missed. They decide to request a response to their question from the paper’s author and attach a small ETH bounty. The original author now sees the question, answers it, and collects the bounty as payment for their time and effort. The size of the bounty offered by a “question asker” or demanded by a “respondent” will be based in large part on the history of the respondent, which is of course public.

As another simple example, a user reads a news article and sees a suspicious claim. They select the claim and create a request for a fact-check on it, assigning that request to whatever fact checking user or organization they choose. The fact checker (using whatever methodology they prefer, from centralized teams of investigators to decentralized face checking DAOs) investigates the claim, then submits a fact-check-report and collects the bounty.

Radically Open For Experimentation

When we say that we are radically open, we mean that our index is kept as simple as possible, so that experimentation can be done on another layer. While we are creating tools as part of the Citadel Suite, if a community-created tool outperforms our in-house tool, users can switch their toolset without losing access to the underlying data.

We intend to release contract interfaces for our features, of which our tools are only one implementation (our implementations will of course also be open sourced). Furthermore, we will develop the DApp so that it accesses contracts via interfaces rather than implementations so if a user prefers a community-developed “User Reputation Score” system, they can simply go to their settings and switch which system they use. Now when browsing, the “user reputations” they see will be generated by the community-created contract, rather than our in-house variation.

We expect this type of experimentation to lead to revolutionary new tools, content aggregators, and analyzers that would never be discovered on the rigidly controlled experiences of web 2.0 social networks. Not only is this a marketplace of ideas, it is a marketplace of tools for working on ideas.

4. Anti-Solutions

Many of the shortcomings of web 2.0 social networks discussed in this paper have been expressed before, as complaints lodged against companies, i.e. “Facebook needs to do something about this!” We contend that the problem requires a holistic approach, and web 2.0 social networks do not possess the tools required to fix what’s broken.

The Top-Down Approach

In contrast to the marketplace of ideas in which a Citadel user takes part, Twitter has taken it upon itself to directly police its users’ interactions by unleashing a watchdog algorithm. Sadly, this system is far too broad and exploitable. In an attempt to curb abuse, Twitter has created a tool for censorship.

Their suspension-dealing watchdog can be perverted by users (either humans or bot nets) that brigade and flag users who disagree with them. Within the marketplace of ideas metaphor, this would be akin to the SEC shutting down Tesla because Ford, Chrysler, and GM all said they found electric cars offensive.

Here’s what Business Insider suggests the average Twitter user do to combat such ineffective and misguided censorship:

“Block anybody at the slightest sign of being a sectarian that hates what you say. Don’t engage in any conversation with those people, a potential denouncer is just giving you rope to better hang you motivating their like-minded sectarians to mass-denounce you to Twitter.” [1]

Most people will likely take this advice. They are literally encouraged by Twitter’s protocol to silence themselves to avoid punishment, rather than further a dialogue.

There is a more insidious layer to this relationship between network and user. As Kalev Leetaru points out in Forbes, this dynamic enables Twitter to engage in high-profile political censorship while maintaining plausible deniability.[2] In the most charitable case, they have inadvertently created a weapon which enables autocrats to muzzle the opposition.

Since they have appointed themselves arbiters of dialogue rather than curators of discourse, not only does Twitter lose the trust of their users, but they salt the fields on which healthy ideas grow.

Incentivized Social Protocol

So how else to combat destructive dialogue? For a web3 network, an alternative to censorship is the utilization of cryptocurrency to reward those who create and interact with content. Under such a protocol the marketplace of ideas ceases to be a metaphor, and users literally compete for economic gains.

Steemit suggests that this protocol is a quality control solution.[3] As they put it:

“Steemit is not a ‘get rich quick’ scheme… Most of the authors that you see earning high rewards are users that have spent a lot of time in the network building followings, making connections with others, and developing a reputation for bringing high quality content.”

Unfortunately, many of Steemit’s most successful users feel differently. The economic rewards are exploitable by bot voting[4], and encourage the creation of low-quality clickbait[5]. Though some users have attempted to embrace this,[6] it’s an uphill battle to curate productive dialogue with an incentivized social protocol. A complex economic mechanism built into the protocol is the wrong solution.

The resulting optics are less than desirable. A visitor to such a network is presented with a deluge of unimpressive posts suspended within a competitive framework, and long lists of canned comments by bots linking to their own low-effort contributions.

This is no surprise. Ideas that compete for clicks and votes value only instant appeal. Ideas that compete for lasting share of mind must use the language and currency of persuasion.

Economic incentives are a powerful capability of web3 social networks, but there is a tempered and constructive way to let users experiment with them. A reward-centric social protocol restricts the scope of the platform. This is further discussed in the “Bounties” section of this paper.

As a side note- while we disagree with their specific direction, we appreciate Steemit’s experimentation in this field.

Banning Bots

Bots are often thought to be a plague on the social media ecosystem.[7] People tend to associate them with viruses or scams or spam attacks. However, it is a mistake to conflate “bots” and “bad actors”. Not only can bots be incredibly useful (and we are in the infancy of their usefulness[8]), but bad actors can certainly be human.

Furthermore, as bots evolve into AI, the boundary between flesh-based users and software-based users will blur. Networks that prohibit software-based users will be locking themselves out of a huge userbase that contributes considerably to discourse.

We are attempting to combat bad actors as a whole. Not by clumsily banning them, but by introducing mechanics that make their behaviors ineffective.

Bad actors rely on the frictionless viral nature of social media to disseminate their ideas. By adding economic friction we hope to 1) make spamming cost-ineffective for bad actors, 2) create a psychological (and economic) threshold that good actors must overcome in order to promote content. We believe that a small amount of economic friction like this will not be a burden on good actors but will lead them to be more careful with what they promote, theoretically limiting the influence of low quality content from bad actors.

Strict Identity Verification

Similarly, some social networks misguidedly reject users who choose to identify themselves in a way that doesn’t align with the names sanctioned by their government.

There are numerous reasons a user might have to identify pseudonymously or anonymously. Perhaps their government, community, or family would punish them for what they express. They could be more easily doxed by those who wish them harm. Perhaps the name they go by is simply not their name of record.

Facebook famously (and callously) implemented a “real name policy” that disproportionately harmed queer users.[9] Twitter as well has a specific “verified user” policy, though it’s not required to use the platform.

While it is potentially useful know whether a user’s stated identity corresponds to their “real life identity”, a centralized corporation should never be the sole arbiter of what constitutes that identity.

Related Readings:










5. Tokens

A token to spend and a token to hold.

The following is a proposed token system in early development and is thus likely to change. A full legal review will be done before any token release to ensure compatibility with all applicable laws and regulations. This paper is not an offer to sell any future shares or tokens.


  • Raise funds for development
  • Widely distribute tokens used to post to ink
  • Promote growth
  • Reward funders

To accomplish these, we would create and distribute two separate tokens that serve different purposes in the ecosystem. Though they would have different utilities, both INK and CITA are ERC20 tokens and could be exchanged for ETH, another token, or fiat currency.


The token used to post on the ink index is INK. INK would always be available for sale from its token contract (tokens could be minted on receipt of ETH if necessary), and it is not intended to appreciate in value. We would set and update the price of INK (as well as the cost in INK of posting) in order to (within reason) incentivize posting and discourage holding. With this in mind, it is very unlikely that an INK token would increase in value over time, and most likely the opposite is true. INK holders would be free to sell their tokens to whoever they wish- something we strongly encourage (especially immediately following our token sale) in order to get small amounts of INK into as many hands as possible.

Why not just use ETH?

You can! All fees would be payable in ETH or INK. The purpose of distributing INK is to jumpstart the ink index. Eventually we believe the vast majority of users would pay their fee in ETH, but we would continue to distribute INK to good actors to promote creation of quality posts.


In order to return value to funders and bring democratic structure to our organization we would create the CITA token. CITA would be sold only during our token sale. A (to-be-determined) portion of ETH collected from smart contracts would be used to buy & burn CITA. No less than once per year, starting no more than 2 years from the end of token sale, owners of the CITA token would be able to vote on proposals regarding a variety of Citadel features, e.g. reputation scoring mechanic, discrete reactions, integration with other decentralized apps, and more.


Leading up to our token release we intend to release a prototype and Alpha version of Citadel. In order to develop the best network possible, we need feedback from the outset. We’re not especially concerned with the notion of exposing an unfinished product, as ultimately the users interested in a prototype are likely highly technically literate and capable of looking past small bugs and UX issues. Moreover, we would feel uncomfortable denying token release participants the opportunity to see a proof-of-concept.

Token Sale

Though specific details concerning date and length of our token sale are forthcoming, we can still announce that both tokens will be distributed. Sending ETH to the sale contract will grant the sender CITA as well as INK. Thus, by participating in the token sale, an buyer will receive CITA for potential long term gains and a voice in the development of Citadel, as well as a large amount of INK in order to help “jump start” the index (through posting and distributing INK to other parties they think would add value to the index).


High quality content will be crucial to the initial success of Citadel. We look forward to establishing ourselves as a platform for academic/journalistic discussion by awarding INK for free to various institutions and individuals. This would include universities, think tanks, journalists, community members, prototype users, and other potential contributors.

6. The Non-Profit

Citadel Guardianship

We seek to create a non-profit to ensure that Citadel fully realizes and maintains its role as a tool for the public good. It will be funded from ownership of a significant portion of all CITA.

Many helpful tools could be best developed by an organization that is not financially motivated. Wikipedia, for example, has gained the trust of billions in large part because it is a non-profit. We seek to form a non-profit that handles some of these tasks without the constraints of the for-profit organization.

The non-profit should assume guardianship of Citadel in 5 key areas each with its own team and associated account operating on the platform:

Verification/Bot Detection

By tying a user to their real-world identity we increase the user’s accountability for their ideas, and reduce the opportunity for trolling and anonymous spam. In addition to creating “social friction”, verification will affect a user’s surfacing weight. In-house bot detection and tagging will be vital to maintaining the integrity of our platform.


Fact-checking as a feature of online dialogue has become increasingly socially desirable.[1] On a platform like Facebook, which lacks economic and social friction, it can be an overwhelming undertaking.[2] Blockchain lends itself to fact-checking, and the Citadel Suite will contain a tool for verifying claims within posts that enables users or organizations to offer themselves as fact-checkers. The non-profit will create an organization that operates alongside third-party services such as RealityCheck and WikiTribune, as well as any community-designed services.[3][4] Our fact-checking system has no special priority over others, but we seek to earn the trust of our userbase.

Licensing/Rights Acquisition

Whereas verification and fact-checking are reactive forms of quality control, a more proactive facet of the Citadel NPO will be devoted to securing the rights to documents and media that may otherwise be inaccessible to users partaking in a relevant discussion.[5] As we work out licensing agreements with cloistered academic journals the marketplace of ideas will thrive. Once esoteric concepts would become commonplace in such a knowledge-friendly environment.

Boosting Disadvantaged Groups

In keeping with our core values of spreading knowledge and respecting users, it is the duty of Citadel to boost the visibility of underrepresented groups and their content. Our boosting program will consult with organizations such as Charity Navigator to seek out candidates. Additionally, users will be able to directly request “surfacing grants”.

Comprehensive User Feedback

We believe that feedback should live up to its name. User feedback on Citadel will consist of a transparent, continuous correspondence with the user. This team will maintain a meta-dialogue, and be an advocate for users.

Stewardship of Industry Ethics

In the same manner that social media companies today send developers to conferences on habit-forming design[6] and hire teams of psychologists to maximize time-on-screen, the non-profit will work to spread our own ideals throughout the tech industry. Our philosophies are detailed in the “Guiding Values” section of this paper.





[5] academic_journals.html


7. Creating Value Without Advertising

Advertising is the primary economic mechanism of web 2.0, generating profit for social networks by selling user data and reinvesting that profit in the user experience (with the goal of keeping users online and thereby increasing exposure to ads). As the structure for a marketplace of ideas this is clearly perverse.

We feel that this model is not only unconscionable but economically unsustainable. Let’s examine some developing trends in the relationship between content creators and consumers.


Adblock Plus has had 500 million total downloads as of of Jan 2016, and estimates 100 million unique users. According to PageFair’s Google Consumer Survey, 74% of users will leave a page when they encounter an “Adblock wall”. And this recalcitrance is surging. Mobile Adblock usage more than tripled in one year, increasing from 108 million to 380 million active devices globally from Dec 2015 to Dec 2016.[1]

Put another way: 47% of the global population uses the internet, and 23% of them use adblock.[2]

This has not gone unnoticed by Facebook,[3] Google,[4] and the digital media community.[5] But they have made it clear that they feel consumer is to blame for the failure of this model, and have merely made token compromises like less obtrusive banner ads and native advertising.

Former Google executive Ben Barokas offers this take:

“One of the consequences of using ad blocking software is that it significantly damages the value exchange between consumers and creators of digital content… Otherwise, little by little, content will go away.”

This sentiment is echoed by the actions of digital media giants. Adblock detection software is becoming an industry in its own right, publishers have begun bribing Adblock services for white-list status, and user-shaming language is appearing across the web.

Despite this effort to place the burden of a broken economic model on the consumer’s shoulders, the concept that advertising is the only thing keeping high-quality content alive is demonstrably false.


Tipping is the direct transfer of money from consumer to creator, often in real-time for livestreamed content.[6] But the concept can be expanded to include one-time donations or scheduled patronage of a content creator.

While the average internet user becomes less and less tolerant of advertising, tipping and patronage have seen a dramatic increase in adoption. Streamlabs processed $23.5 million in Q1 2017, a 13.0% increase quarter-over-quarter from $20.8 million in Q4 2016. The share of tips paid out to Twitch streams not partnered with advertisers was 42%.[7]

Not only are users trending towards a tip-based economic mechanism,[8] but creators prefer it over the inconsistent and unfriendly monetization practices of platforms like Youtube[9]. Ad-based platforms serve only the interests of advertisers and the platforms themselves. As such, we anticipate tipping will become the default method by which content creators are rewarded once access to a wallet containing ETH is trivially simple for the average user.

By removing advertisers from the creator-consumer transaction, the content can more directly reflect with the desires of those two parties. This “intention economy” is a far healthier system than the attention economy of web 2.0.

Contracts & Bounties

Citadel takes this paradigm a step further by encouraging direct creator-consumer transactions on all vectors, including interpersonal. We will accomplish this by encouraging users to engage in response-request smart contracts with one another. Rewards are collected by completing contracts and by posting popular bounties (where users collect a fraction of the ultimate bounty). A few examples:

1. Vitalik Buterin posts a white paper to ink and another user desperately desires some clarification. She can post a reply including a smart contract requesting Vitalik to respond. She loads a bounty onto the response-request, which other users may add to. Once Vitalik responds, he redeems the bounty.

2. Bob has completed a series of paintings, and would like to commission Alice, an acquaintance and art writer, for a one page critique of his work. Alice is familiar with these requests, and has set her bounty for such a job at 0.3 ETH. Bob posts his work to ink along with a smart contract containing Alice’s desired bounty, which she claims upon responding with her review.

3. Gabriella, an independent comic book writer with a few published works, places an unfunded bounty on herself to crowdsource the funds needed to complete her masterpiece.

4. Galt wants more mainstream online magazines and newspapers to write seriously about multiverse theories- a topic he finds both relevant and fascinating. He posts a request for a long-form article on the subject, submits a bounty to 10 publications, and encourages like-minded users to add to the bounty. The MacDermott Post beats the others to the punch and collects the bounty. Galt collects a fraction of the final bounty as a reward for his popular suggestion. More bounties and articles on the topic appear as a result.

This feature will create a platform for the exchange of valuable information, make interaction with public figures more accessible, and give the user the power to shape discourse in a tangible sense. That power cannot be overstated- if the dynamic from example four is fully realized, content creators will be forced to make money by appealing to the consumer’s explicitly defined desires rather than by exploiting human psychology to get a leg up in the attention economy.

To be clear, absolutely no portion of tips or bounties are claimed by Citadel.

The Value of Constructive Interaction

So how do we make money? We create the ideal space for UGC and content consumers. No ads, no data selling, and no skimming off the top of tips intended for creators.[10] We provide an environment specifically designed to benefit content creators and foster productive dialogue. Then we add economic friction to combat trolls and spam at a rate that is negligible to users but sustainable for the platform.

While Ben Barokas shames the ad-averse user for decreasing the value of social networks, content creators will flee to alternative models and consumers will follow.

Let’s say it costs 9 cents to make a post, reaction, or response on Citadel. If the average user has a modest 3 interactions a day, then in one financial quarter we will have generated $24.57 per user, by offering an ideal forum for UGC and discussion. In contrast, Facebook generates $4.23 per user by selling ad space and the personal information of their users.[11] If we look only at Facebook’s revenue from the US and Canada, that becomes $17.07 per user. And while those rates are more comparable, note that the average user spends 59 minutes a day on Facebook. A moderately active Citadel user could make three $0.09 interactions in a small fraction of that time.

Our user adoption rate will be slow at first, but remember that Citadel welcomes bots and organizations as users. Since all users must pay to post, our profitable userbase is potentially unlimited.

We anticipate that considerable research and tuning in this area will be required, but the main purpose of this section was to put the scope of our financial model in perspective. It is vastly more efficient than that of web 2.0, and has the user’s interests at its core.

Related Readings:












8. Features

A quick review of why Citadel is the cure for what ails social media, from the user’s perspective:

Immutable posts with easily accessible revision histories.

The marketplace of ideas brought to life, made tamper-proof, and stored publicly until the end of time.

Discrete reactions designed to improve the quality of discourse.

A constantly evolving tool belt that allows users to engage in productive dialogue, avoid echo chambers, and identify bots.

Response requests and bounty system.

Empowering the user through smart contracts. Tools for freelancing, crowdsourcing, engaging with public figures, and directly influencing content creation.

ink Graph

A visual representation of the history of posts, discussions, ideas, and everything else on the ink network.

Rejection of targeted advertising.

The absence of private data collection by Citadel or targeted advertising by third parties. A social media user experience free from the snares of the attention economy.

9. Technical Design Overview

Technical design is subject to rapid change. This section was last updated 10/24/17.

The Ecosystem

  • ink is the protocol on which posts and responses are indexed.
  • The Citadel Contract Suite is a set of contracts that correspond to discrete actions (reacting to a post, putting a bounty on a post, tagging a user as a bot, etc)
  • Citadel is a front-end (app, web-app, etc) that merges together data from ink and the Citadel Contract Suite (and potentially other contracts as well) to render posts and provide the necessary UX for interaction with these contracts.

ink Protocol


  • Acts as a generic (content agnostic) index of published content, in a structure that is well suited to serve as a backbone for public social networks.
  • Resistant to censorship and data loss.
  • Resistant to manipulation by bad actors
  • Scaleable to levels of traffic similar to those of popular social networks (Twitter, Facebook, etc)

Design (general)

  • We use a decentralized storage layer to store all content.
  • The index is backed by a blockchain.
  • The index maps user to submissions and allows for submissions to be updated with new revisions (of course, the revision history is maintained)
  • Submissions also track references, so that each submission (and user, and revision) functions as a node in a graph of social network activity.

Design (prototype and alpha)

  • The index will be built in an ethereum smart contract published on a private testnet.
  • All content is published to The Swarm[1] using the web3.js library (`bzz.put`) from the web front-end. The hashes returned by this function are then added to the index as a mapping of user to submission via an ethereum transaction.
  • An event fires when content is added to the index so that various services and/or clients can be notified of the new post.
  • Content registered on the index (Swarm hashes) will be “pinned” by a server so that it isn’t lost if the user that posted it doesn’t host it and it doesn’t get hosted by other nodes. (this is a bit of a hack for the alpha)
  • The index will also be cached on a server to improve performance (this is also a hack, for the alpha only) but after loading content (e.g. posts) we will validate against the blockchain.

Design (beta+) — same as above except:

  • Index published on public testnet.
  • The index will likely be built as a Plasma contract, to greatly reduce gas cost associated with adding to index as well as to improve performance.
  • The index smart contract associated will also take care of ensuring that content posted remains available. This likely means that upon a piece of content being registered on the index, the index contract will interface with a system such as FileCoin (may involve switching to IPFS from Swarm, which is not a very big deal)

Design (v1) — same as above except:

  • Index published on main ethereum network.

Contract Storage Structure:

  • The index data of posts can be identified and retrieved via a 3-tuple key made up of the user’s ethereum address, the submission index, and the revision hash.
  • Mapping (user address => User)
  • User
  • Mapping (submission index — uint => Submission)
  • Uint — numSubmissions
  • Submission — bio submission (special submission that represents the bio of the user)
  • Submission
  • Mapping (revision Hash — bytes32 => Revision)
  • Revision
  • bytes32 — Content Hash
  • uint — timestamp
  • 3-tuple[] (address, uint, bytes32) — reference link keys

Contract API:

  • Transactions:
  • submitBioRevision(bytes32 revHash)
  • postNewSubmission(bytes32 revHash) — create a new submission with 1 revision with the provided hash
  • submitRevision(uint subIndex, bytes32 revHash) — update an existing submission
  • respondToSubmissionRevision(address op, uint op_sub_index, bytes32 op_rev_hash, uint subIndex, bytes32 revHash) -
  • Constant Functions:
  • doesPostReferencePost(address refUser, uint refSubIndex, bytes32 refRevHash,address opUser, uint opSubIndex, bytes32 opRevHash) returns(bool)
  • doesUserReferencePost(address refUser, address opUser, uint opSubIndex, bytes32 opRevHash) returns (bool)
  • doesPostExist(address user, uint subIndex, bytes32 revHash) returns (bool)

Contract Events:

  • NewRevisionPosted (address indexed user, uint indexed subIndex, bytes32 indexed revHash)
  • RevisionReferenced (address indexed opUser, uint indexed opSubIndex, bytes32 indexed opRevHash, address refUser, uint refSubIndex, bytes32 refRevHash)


  • It is possible that the Plasma project does not come to fruition. We may have to explore other technologies to achieve the necessary scale and reduction in fees. A hybrid approach (similar to that of the alpha) in which a conventional server is used to cache the index and improve loading speeds may have to be used in v1, if a purely decentralized solution is not able to provide an adequate UX at scale.

Citadel Suite

  • The Citadel Suite is a set of smart contracts that operate as layers on top of the ink protocol, so that discrete actions (such as reactions, requests & bounties) can be added without tampering with the protocol.
  • As such, there is no single design that necessarily describes all contracts that will ever exist in the citadel suite. Furthermore, there will be many contracts designed by the community that achieve widespread adoption that we will have no control over.
  • However, there is a design pattern that will likely be used in many simple contracts that we describe below.

Example Design Pattern: “Reactions”

  • The contract is structured as a wrapper around ink, with the ability to query ink to ensure existence of posts/users/references/etc.
  • Similar to how ink maps ethereum addresses to “Users”, a citadel contract maps ethereum addresses to “UserExtensions”.
  • Likewise, the “UserExtension” struct maps indexes to “SubmissionExtensions” which in turn map hash values to “RevisionExtensions”.

· Reactions are recorded on the “RevisionExtension” (an event is fired and they are added to the contract storage)

10. Roadmap

Note: If expected web3 technical advancements are delayed, our Production Release may utilize a hybrid system in which conventional servers are employed to enhance the user experience. Our core functionality will exist only on the blockchain, however.

11. Guiding Values

No walled gardens.

We intend to develop a protocol & index upon which a user of the next Twitter could natively respond to a post on the next Medium because both platforms run on the same content-agnostic graph of communication.

Information should be spread deliberately.

The index is designed to preserve information until and likely beyond the end of human civilization (though likely not beyond the end of the universe, be it from heat death, the big rip, the big crunch, eternal inflation, or the discovery that our universe is merely a microverse that powers a scientist’s car battery). With that in mind, we are developing the protocol to have a small amount of friction that guides a user to ask themselves “Do I really want to post this?” That moment of reflection is the real cost of participating in this system that inherently reduces noise.

Tools influence behavior

The behaviors we see on various social media platforms (both the good and the bad) are not simply a result of human nature, but are largely influenced by the tools a userbase is given (and, similarly, the tools a userbase finds attractive). Web 2.0 social networks mostly address behaviors they deem undesirable through top-down mechanisms.

Don’t try to solve every problem.

We intend to make the best protocol and index for information shared publicly (and pseudonymously). While we believe that Ink could become the backbone for a certain type of web3 social network, we are not intending to serve as a protocol for private communication. Not only do we think it’s unlikely that a single protocol would be the best at handling both public and private information, but even if such a protocol is developed we don’t think people would want to use it. People will justifiably be skeptical of conducting private communications on the same index as they post publicly, regardless of how much proof you can show them that their concerns are misplaced.

Respect the user.

Neither ink nor Citadel are capable of knowing private information about users. The back-end and front-end will both be open source and any attempt at user tracking could be thwarted by a user that forks the code and releases a new front-end without tracking. We will never sell private user data to anyone. And any data posted to our network is public and therefore unsellable. While applications built on ink are free to pursue any economic incentive and/or monetization scheme with which they wish to experiment, Citadel will be run first and foremost to serve our users. From the ground up we are focused on ethical design principles. The most concrete example this is our rejection of the advertising revenue model.


Nick Reynolds: Founder, Architect —

Walker Flynn: Front-end Engineering Lead —

Andrew Spiering: Back-end Engineering Lead —

Eric Sokolov: Media Analyst —

Mason Garland: Communications