Bandwidth Swap

What it is

A market for pipes, priced by what it costs to go around them

Most places have one way to get a connection and one company selling it. The company paid to run the line, so it is not in a hurry to let anyone else use it. Bandwidth Swap treats a connection as a product anyone can resell, one hop at a time, and pays the people who run the hops.

The original 2021 paper proposed a blockchain where nodes announced their own uptime and speed and were rewarded for it. That doesn't hold up: a node can say anything. The 2026 revision replaces self-reporting with receipts. A user pays per unit of data, each hop is paid only when the next hop confirms it got the data, and the settled payment is the proof that bandwidth was delivered. There is nothing to attest and nothing to fake.

The part of the design that is still original is the price. A hop's share of a route is set by the opportunity cost of routing around it. A link that is one of five parallel paths earns a fifth. A link that is the only way across a gap earns the whole thing. That is the incentive to build where nothing exists yet.

Mechanism

How a receipt works

Data and payment move left to right, one hop at a time. Receipts return to the payer along the dashed path. The Mint sees only receipts that were already paid.

A receipt is small. The paper's Figure 2 gives the whole format:

(payer NYM, hop NYM, hop index, merkle root, bytes, t_first, t_last, prev receipt sig)
signed by payer

About a hundred bytes. That matters for the kit, because a hundred bytes fits in a LoRa packet, so receipts keep moving when the internet doesn't.

Design constraints

Four rules that make it hard to cheat

Payment is the proof

The only party who can't be fooled about whether bytes arrived is the one who paid for them. So the payer's settled payment is the proof, and no validator ever has to measure a relay.

No reward may exceed its fee

If a relay could earn more for carrying a byte than the byte cost to generate, it would carry bytes to itself. Every subsidy is bounded by this rule.

The Steward can only post bounties

Five percent of every fee goes to the Network Steward, a rule with no discretion. It adds to bounties people post themselves, offers a sole link's fees to whoever builds a second path through a different place on the map, and keeps an offer open for the first link to any mapped place that has none. It never pays for being online, and its money can be taken only by delivering bandwidth (paper, Section 7).

Quality is priced, not proven

A slow relay settles fewer bytes per window and earns less. Speed proofs are required only where a subsidy is claimed, which is the one place a false claim would pay.

Hardware

The kit

Two radios, because physics splits the job. LoRa carries the control plane: receipts, liveness, announcements. It reaches for miles through trees at a few kilobits per second, which is useless for a web page and perfect for a hundred-byte receipt. A second radio carries the data. Which one depends on your terrain.

Role	Part	Notes	Cost
Compute	Raspberry Pi 3 Model B or newer	A Pi 3 covers every role in phases 0 to 2. Its 100 Mbps Ethernet is how it talks to the data radio.	$0 if you have one
Control radio	SX1262 LoRa HAT, or a Meshtastic board over USB	RAK WisBlock, Heltec and LILYGO boards all work. The HAT is tidier; the USB board is easier to start with.	$25 to $40
Data radio, line of sight	Ubiquiti LiteBeam or NanoStation pair, 5 GHz	Tens of Mbps over several kilometers if you can see the far end.	$150 to $200 a pair
Data radio, through trees	Wi-Fi HaLow (802.11ah) or 900 MHz airMAX pair	A few Mbps, but foliage doesn't stop it. The forest option.	$100 to $250 a pair
Power, remote node	20 to 30 W solar panel, 12 V battery, 5 V buck converter	A Pi 3 draws 2 to 5 W and never sleeps. A Pi Zero 2 W draws a third of that if battery life matters.	$80 to $150
Storage	microSD, 16 GB or larger, A1 or A2 rated	Mount root read-only or send logs to RAM. Logging kills cheap cards in months.	$8 to $15

Three nodes make a lab: a gateway at the house wired to the router, a relay at the far end with the LoRa HAT and a 2.4 GHz hotspot for whoever is out there, and a Mint anywhere on the network that collects receipts.

Instructions

Build phase 0 tonight

Phase 0 needs no radios. Three Pis on your home network that keep time, tunnel traffic, and sign receipts. Everything you do here survives unchanged when the radios arrive.

Flash three cards

In Raspberry Pi Imager choose Raspberry Pi OS Lite, 64-bit. Open the settings gear before writing and set a hostname per card, one username for all three, SSH enabled, your Wi-Fi, and your timezone.

Card Hostname Role

1 bw-house gateway and payer, wired to the router

2 bw-forest relay and future hotspot

3 bw-mint receipt aggregator

Use 2.5 A power supplies. Phone chargers under 2 A cause random reboots on a Pi 3, and you will spend an evening blaming the software.
Boot and find them

Power on, wait about ninety seconds, then from your computer:
```
ssh pi@bw-house.local
```
If .local names don't resolve, your router's device list shows three new addresses. On each Pi, update and reboot:
```
sudo apt update && sudo apt full-upgrade -y && sudo reboot
```
Time, tunnel, logs

Every node needs three things, in this order.
- Time. Receipts carry timestamps, so clocks must agree. Install chrony on all three; point bw-forest and bw-mint at bw-house, and bw-house at the internet. The protocol's clock tolerance is 5 seconds; a relay declines payers outside it.
- WireGuard. The data plane. One tunnel, bw-house to bw-forest. On a home network it adds nothing, but it is the exact configuration the radio link will use.
- Logs to RAM. Install log2ram or set journald to volatile storage so the SD cards live.
Run the receipt daemon

The first real code, and there is nothing to download for it. A small service on bw-house and bw-forest that, every hour, reads the byte count on the WireGuard interface, builds the receipt from the format above, signs it with an ed25519 key generated on first run, and sends it to bw-mint. The Mint verifies both signatures and appends the receipt to a ledger.

Your first dispute test: make the two byte counts disagree and see what the Mint does about it. The pilot's definition of success is that a dispute resolves from the receipt data alone.

Card	Hostname	Role
1	`bw-house`	gateway and payer, wired to the router
2	`bw-forest`	relay and future hotspot
3	`bw-mint`	receipt aggregator

Phases 0 and 1, on the bench and next door

Lab status

Six Raspberry Pi 3 B boards running the kit, at two houses. Three sit at the house on one home network: bw-house, the payer and the Mint's radio gateway; bw-mint, the Mint; and bw-forest, the bench hop, installed and idle. Three are next door, on the neighbor's Wi-Fi and reached over a tailnet: bw-neighbor, since October 18 the hop the house pays (bw-house buys 100 MB an hour through it, signs a receipt for the bytes that crossed, bw-neighbor answers with its own count, and bw-mint settles the window at the smaller of the two); bw-cabin, the future forest node; and bw-mint2, an empty second Mint whose LoRa board relays for bw-neighbor. The link's agreement margin is three percent since October 30, set from a week of windows (the backlog, B11): the two meters now agree to within about one percent, and a window past the margin settles as a dispute, at the smaller count. October's invoice, written by the Mint itself on November 1: 336 windows, 35.22 GB, $3.65 to the relay. Since November 2 the house pays ahead: a dollar on deposit at the Mint, a lock for the coming window posted after each receipt, and every window since ten that morning settled against its lock (the backlog, B2). The T-Beams carry receipts and acknowledgements over LoRa since October 24, and on October 26 a window settled with the tunnel to next door blocked. Every ten minutes, and right after each hour's commitment, the Mint posts a summary of its ledger, signed with its own key; the map and the ledger below are that summary, and this page checks the signature in your browser. No node accepts a connection from the internet.

loading
status feed

● up: receipt within 90 min ● stale ○ idle: a hop not in use disputed: the two counts differed by more than the link's margin; settled at the smallerempty: no receipt · bars are log scale

Loading the status feed…

A node is up when the Mint has a receipt from it within the last 90 minutes (receipts are hourly); the Mint is up when its report is under fifteen minutes old (it posts every ten) and its ledger service answers. A hop is idle when it is not the one the house pays and has had no receipt in that time. A disputed window is one where the two signed counts differed by more than the link's announced margin (three percent on the neighbor link since October 30, 2026; one percent is the pilot's default); it settles at the smaller count, like every other window. Under the Mint is its latest commitment, a signed root over the hour's settlements that anyone holding the receipts can rebuild with the kit and check. The report itself is signed by the Mint, and this page checks that signature and the commitment's proof in your browser with docs/bsp.js, so the feed that relays the report has nothing to be trusted with: it can delay a report or drop one, and cannot alter one. The feed carries names, roles, times and byte counts, since November 2 each payer's prepaid balance, and nothing about the networks the boards sit on.

Check a proof in your browser: paste a proof from the Mint's bwkit prove and a second implementation of the rules, sharing no code with the kit, checks the Mint's signature on the hour's root and each settlement's place in it, sending nothing anywhere.

The Steward's book: the rule that takes five percent of every fee and can only spend it as offers to buy bandwidth on links the network wants; its balances, open offers and payouts, drawn from the feed once it runs.

The network: every Mint the map lists, with its domain, its places and its last report, and the map itself, a record signed by the Mint that keeps it. One Mint so far; the feed takes any Mint's signed report, and the map says who is listed.

What an operator sees: the dashboard every node serves at its own address, in snapshots of the lab's four nodes taken on October 18, 2026 and drawn by the page's modules as of November 1 (the verifier in them needs nothing from the browser). One page, three views: the Mint's, a node's (a hop or a payer), and the fleet's, for someone running several nodes or Mints. Nothing on them is live; a node's own page is.

Plan

Roadmap

Phase 0one eveningThree Pis on the home network. Time, tunnel, receipts, one Mint. You pay yourself. Proves the receipt code and the clock rule.
Phase 1one weekendRadios in. House to forest over a 5 GHz or HaLow pair, receipts and liveness over LoRa. Unplug the house's internet mid-window and show settlement still closes.
Phase 2a monthA neighbor operates the ridge. The Steward's rule runs for the first time, by hand: it matches the first bounty someone posts and offers a second path around the ridge. Paid in dollars on receipts. First real dispute.
Phase 3openOpen-source the kit and the Steward, which is the bounty board. Anyone can post a purchase commitment on a named link or a mapped place and fund it, the Steward matches it, and the paper's Section 5.1 says how one settles and refunds. Anyone can build it.
Phase 4north starLinks into places where the internet is forbidden. This is the right long-term target and the wrong next step: receipts prove delivery, not location, and paying for a node in a hostile jurisdiction needs a location proof that doesn't exist yet, legal review, and an incentive design that never makes a border crossing the thing being paid for.

Honesty

What we don't know yet

Version 0.6 of the paper took the default on every question in the backlog, built Phase 0 on them, said what seven essays on commerce across long delays made it say, sent the five percent to a Steward that can only post bounties, and then let the first link off the bench set how far apart two honest counts may be. What it still cannot settle is its Section 10; this is that list, in the paper's order. The backlog keeps the options behind each default.

Whether a bounded match moves anyone. The Steward can add to a link in proportion to its own traffic only below the five percent it takes, and the rest of its income goes to second bridges chosen by the map. If neither gets a link built, what is left is lifting the cap by charging for payer identity instead of counting fees, which needs a figure for what a fake payer costs to manufacture. A simulation of one operator running payer, relays and Mint decides it.
The placement rule. The Steward's programs read the map, so their judgment comes down to how a place proves it is distinct from its neighbor, and the anchor mechanism answers that at the resolution of a radio. Someone who builds anchors on two hills has built two bridges even if one party owns both, and the protocol cannot see ownership. A simulation of the rule found its first hole before publication, a sole bridge's owner collecting a second-bridge bounty through a second place it owned, and a cap on what the Steward pays out per payer closed it.
The customer. The pilot's use case is backhaul between two sites that already overbuy capacity, because the authors can supply both ends. Whether anyone picks this over a carrier contract, a satellite or a VPN, only paying traffic answers.
Receipts under route privacy. Whether a Mint can verify a chain of receipts without learning the route.
The settlement layer. The paper names three candidates and picks one when an untrusted party joins. The cost of each hasn't been measured.
The Mint committee. One proposer and four attesters is the target. The pilot has one Mint and fraud proofs.
Attestation for the subsidy tier, or replacing it with bond age and diversity.
Open relays. Relay service is between members. Carrying strangers' traffic to the public internet raises liability the paper doesn't address, and it isn't in the pilot.
Attribution. Endpoint service puts a payer's traffic on the public internet under the relay's address, and the relay can't see what it carries. The receipt chain records who bought the window. What a relay may refuse by destination or policy, how it says so, and what the record is worth outside the membership aren't written. The first purchase across the neighbor's link ran into it: a public service that had served the house all evening refused the same download the moment it came through the neighbor's connection.
The token, its status and the Steward's legal shell, all deferred until there is traffic to denominate. Nothing in v0.5 creates or destroys a unit, which lets the books close in dollars and is not a peg. The unit question itself comes back earlier, at the first bridge between two worlds' bookkeepers, and the paper now names the three answers; which one a bridge uses is the bridge's to announce.
Clock drift between sites. The relay has left the bench, and the two sites' clocks, each on its own time source, are sampled every ten minutes. The first night's reading is about a millisecond; the number that belongs here is a week's.
The levels. The paper now says what the carry is for, what custody costs and what a bridge relay's two bonds do. It does not know the numbers: how large the bonds must be against what a bridge earns, or the carry at which a prepaid window on a contact that may never come is worth opening.
How Mints' reconciliation is encoded. What it carries and what it is for are now stated. The bytes on the wire are not.
Whether proving allowances attract real testers (Section 5.1), or only a relay's second identities.
Payers at a place. Whoever connects at an access point is a payer with a NYM, or the poster pays for them through the commitment. That is an application as much as a rule, and it is the Phase 2 work.
Readmission. An excluded bookkeeper may return once it reconciles and remits what it owed to its Steward. Who decides that it has, with no committee, is governance, and the pilot has none.
The lifetime of a receipt. A link now names its signature scheme and how long a receipt stays presentable. What a Mint does with one presented too late, and how a network moves every link to a stronger scheme before the old one breaks, are not written.
The horizon for institutions. Payment is the proof inside the payer's horizon, which for an institution is the institution's life. What the protocol does with a window whose payer's Mint outlives the payer is the question every estate has had to answer, and the paper has not.

Phase 0 settled the clock rule and the dispute path on the bench, rebuilt the ledger from the parties' signed copies, publishes the hourly commitment, has settled its first window across a relayed path from a neighbor's house (Section 9), and since November 2 locks each window's value before the window opens (Section 3.6). Phase 1 is the offline-settlement test. The economic questions get a simulation alongside. Location left this list because the paper stopped trying to prove it: a commitment can buy service within a radio's range, never presence (Section 5.1), and Phase 4 stays a north star.

Read the open questions backlog

Writing

Field notes

Short pieces on what the protocol rewards and where it strains, written as the lab runs. All field notes.

The Wash Trader's Second HillOct 17, 2026 · the first rule in the paper broken by running it, a bounty a sole bridge's owner could collect through a second place it owned, and the cap that closed it · 5 min
Follow the Bytes, Follow the MoneyOct 17, 2026 · interactive: three maps of the market, a street, a forest and four worlds, each with a switch that takes a link down, and the prices and money before and after · 12 min
The Light Delay TodayOct 17, 2026 · live: how long light takes to reach Mars and the Moon right now, a year back and a year ahead, drawn from the orbits in your browser
Receipts Across the Light DelayOct 17, 2026 · which parts of the protocol survive a light delay, which break, and what a backbone between worlds would need · 8 min
The Receipt Is the ProofOct 17, 2026 · what the protocol pays for, what it refuses to pay for, and what three computers on a bench showed · 6 min

Reading

The paper

Bandwidth Swap v0.6 (draft)Oct 18, 2026 · what the first link off the bench taught: the agreement margin belongs to the link, what is counted and whose cost the rest is, the padding hop, attribution · opens in a new tab, downloadable as plain text
The paper in plain wordsv0.6 · the argument without the machinery, for anyone · 10 min
The paper for operatorsv0.6 · what you run, announce, sign, earn and can lose, for anyone who would run a node · 15 min
Bandwidth Swap v0.1Aug 2021 · Robert Douglas and Chris Odom · as published
What changed in v0.6, side by sideevery edit from v0.5 to v0.6
Bandwidth Swap v0.5 (draft)Oct 17, 2026 · the fee goes to a Steward that can only post bounties, with a map of bodies and places · Markdown
What changed in v0.5, side by sideevery edit from v0.4 to v0.5
Bandwidth Swap v0.4 (draft)Oct 17, 2026 · the paper aligned with the essays on commerce across long delays · Markdown
What changed in v0.4, side by sideevery edit from v0.3 to v0.4
Bandwidth Swap v0.3 (draft)Oct 17, 2026 · the open questions resolved, the pilot, and Appendix A on links with delay · Markdown
What changed in v0.3, side by sideevery edit from v0.2 to v0.3
Bandwidth Swap v0.2 (draft)Oct 8, 2026 · receipt-based proof of bandwidth, new Section 3 · Markdown
What changed in v0.2, side by sideevery edit from v0.1 to v0.2

If you read one section, read Section 3 of v0.6. It is the argument that a settled payment is a proof, and the one condition under which that argument holds. The same paper is written three ways: in full, in plain words, and for the person who would run a node.

Contact

Get involved

Useful right now: people with a Pi and a line of sight to somewhere that has no connection, people who have run a Meshtastic or Ubiquiti link and know what breaks, and anyone who can poke a hole in the Sybil argument.

bandwidthswap@pm.me

The kit, the receipt daemon and the Mint for Phase 0, is at github.com/bandwidthswap/kit. Its sim/ runs the paper's rules over five installations and three attacks; the figures in the field notes come out of it, and so did the first hole in the Steward's rule. The site, the paper and the backlog are at github.com/bandwidthswap/bandwidthswap.github.io.

Build a link where there isn't one. Get paid on receipts.