Technology
Architecture CNP Execution Consensus Security
Build
Documentation AgentKit Grants Program
Ecosystem
Community Roadmap Token Economics
Agents
Whitepaper Start Building
Technology

Certified execution. Lane isolation. Zero contention.

Ferros doesn't optimise the EVM. It bypasses it entirely for known operations — and isolates everything else into lanes that never compete for resources.

Scroll down to nerd out
The Problem

Two bottlenecks every chain hits.

Every parallel execution engine eventually crashes into the same two walls. We tested every published strategy. None solved both.

Bottleneck 1

Shared Mutable State

DashMap, ConcurrentHashMap, AccountsDB — every chain uses some variant of shared mutable state during execution. Under parallel writes, threads compete for shard locks. This caps scaling regardless of how clever the scheduling is.

Bottleneck 2

The EVM Itself

A native ETH transfer through revm costs ~2us. The same operation as pure Rust — two HashMap lookups and two writes — costs ~200ns. For known operations, we pay 10x overhead for interpreter dispatch, gas metering, and memory management.

What others tried

Approach Used By Peak Speedup Why It Breaks
Frame Barriers Batch-parallel schemes 1.8x N-1 synchronization barriers cap parallelism
Multi-Version State Database-style MVCC 0.16x Lock contention in version chains — slower than sequential
Block-STM Aptos 0.4x 80-90% wasted execution at any real contention
3.8x
Ferros DDWS — Ferros Chain

Pre-computed dependency graph + work-stealing execution. No multi-version state store. No speculative re-execution. Every transaction executes exactly once. Both bottlenecks eliminated.

What the fastest chains still get wrong

None of them question two axioms: all transactions must execute through a VM, and gas must be priced in a volatile token.

Aptos Speculative
Block-STM: execute all txs speculatively, then validate and re-execute on conflict.
At 10% contention, 80% of execution is wasted. Real DeFi blocks have concentrated hotspots.
Solana Contention
Sealevel: declared access lists enable parallel scheduling.
VM still processes every tx. State lives in global AccountsDB with lock-based access. No native fast path.
Monad Sequential
Pipelined execution: process block N+1 while committing N.
Hides latency but doesn't increase within-block parallelism. A single block still executes sequentially through the EVM.
The Solution

Certified Native Paths

Formally verified Rust functions that produce identical state transitions to their EVM equivalents. No interpreter. No gas metering. No bytecode dispatch.

ERC-20 Transfer Execution Time

10x faster
Standard EVM (revm) ~2,000ns
interpreter + gas metering + DB trait
Ferros Lane A (CNP) ~200ns
native Rust
Formally verified

Each CNP is mathematically proven to produce identical state transitions, events, and reverts as its EVM reference implementation.

Predictable pricing

Your ERC-20 transfer is $0.002 — worst case $0.008 during rare congestion. No gas auctions, no volatile token pricing.

Governance-managed

New templates are added by governance vote. Not a precompile, not a JIT compiler. Business logic, not cryptographic ops.

Breakthrough #2

Zero contention during execution

No transaction modifies shared state during execution. Every lane reads from an immutable Arc<HashMap> snapshot — O(1) creation, zero locks, zero contention.

Writes are captured as write-intent logs and applied in a deterministic commit phase using optimistic concurrency control. Conflicts are detected by read-set validation and resolved by re-execution in global tx order.

This is fundamentally different from every other approach. Aptos speculatively writes to shared state and rolls back. Solana locks accounts. Monad processes sequentially. Ferros lanes execute against an immutable snapshot — no locks, no rollbacks, no contention.

Other chains (shared mutable state)
Thread 1
READ
BLOCKED
Thread 2
LOCK
READ
BLOCKED
Thread 3
WAITING
READ
LOCK
Threads compete for shard locks on DashMap / AccountsDB
Ferros (immutable snapshot)
Lane A
READ snapshot → write intent log
Lane B
READ snapshot → write intent log
Lane C
READ snapshot → write intent log
All lanes read the same immutable snapshot. Zero locks. Zero contention.
☑

Self-Healing Execution

Every block, 1% of Lane A transactions are randomly re-executed through the EVM and compared against the native result. If they ever diverge, the native executor is automatically deactivated, the registrant is slashed, and affected transactions are re-executed through the EVM. Probabilistic audit adds <1% overhead while catching bugs within a few blocks.

1
Precheck
→
2
Auth
→
3
PolicyGuard
→
4
Execute
→
5
Commit
10x
Lane A vs EVM
35x
State root speedup
<1%
Conflict re-execution
Architecture

Five lanes. One deterministic commit.

Known operations run on certified native Rust — purpose-built, audited, and 10-50x cheaper. Unknown operations run on a full EVM. Both are available to everyone. Economics decide what lane you drive in.

A

Simple Ops

ERC-20 transfers, approvals, payments. Native Rust. No EVM interpreter. No gas metering.

$0.002
Certified Native
B

Native Transfer

Native currency transfers. Zero calldata. The simplest and cheapest operation on the network.

$0.001
Certified Native
C

Standard DeFi

DEX swaps, lending, staking. Certified native execution for common DeFi patterns.

$0.01
Certified Native
D

Complex Ops

Multi-step compositions, complex DeFi. Native execution for advanced certified patterns.

$0.05
Certified Native
E

Open EVM

Full EVM compatibility. Deploy anything — Solidity, Hardhat, Foundry. The permissionless innovation lane.

Gas-based
EVM Interpreter
State Management

Your data is never lost. You never pay rent.

State Gravity: a single canonical state root over all state, proof-carrying cold reads, and fair pricing. No state expiry. No user-provided Merkle proofs. No data loss.

How It Works

Proof-Carrying Cold Reads

When a transaction touches dormant state, the proposer includes a Merkle witness (key + value + proof) in the block body. Validators verify the witness against the parent state root — no live archive dependency during execution. One-time thaw fee of $0.005 per key, then the state is hot again.

State Economics

Creation Bonds & Deletion Rebates

Creating a new storage slot costs $0.005 ($0.002 permanent + $0.003 refundable bond). Delete the slot later and get $0.003 back. This creates a natural incentive for state cleanup — without forcing it. Active users pay nothing extra. Only returning dormant users pay the thaw fee.

$0.005
thaw fee per key
$0.003
deletion rebate
5 GB
hot state at Year 5
0
data ever lost
Security & Safety

Protocol-level controls, not smart contract hacks

Agents need guardrails that survive code bugs and key compromises. Ferros enforces them at the protocol layer — before execution, not during it.

PolicyGuard

Spending limits, velocity caps, whitelists, business hours, and selector gates — enforced at the protocol level before execution begins. Zero gas consumed on rejection.

Policies cannot be removed by the wallet owner alone. Removal requires multi-sig authorization + timelock. A compromised key cannot silently disable spending limits.

Overhead: ~20ns for wallets without policies (one HashMap miss). Microseconds with policies.

Native Account Abstraction

Not ERC-4337 bolted on as a smart contract. Genesis-level architectural decision. Every account has a validation scheme dispatched through a layered pipeline.

Smart Accounts run validation in a restricted sandbox: own storage only, no external calls, no environment opcodes, no state writes. Prevents validation DoS attacks that plague ERC-4337.

EOA fast path: O(1), no EVM execution. Session keys, multisig, social recovery live as account logic.

Nonce Domains

Standard nonces force strict ordering. An agent sending 100 independent transactions must serialize them. If tx #50 fails, txs #51-99 are stuck.

Nonce domains solve this: each account has multiple independent nonce sequences. An agent sends transfers on domain 0, governance votes on domain 1, oracle updates on domain 2 — all in parallel, none blocking each other.

Domain 0 is standard Ethereum-compatible. Domains 1+ are independent parallel lanes.

Certified Template Registry

Lane A native executors are not trusted blindly. Each template is pinned to a contract codehash, verified against storage invariants, and must pass millions of differential tests (native vs. EVM producing identical state transitions).

Registrants stake collateral. If probabilistic audit detects divergence, the template is deactivated and the registrant is slashed — automatically.

Codehash pinning, proxy awareness (ERC-1967/UUPS), no-delegatecall constraint, bytecode analysis.
Consensus

Sub-second finality. Running on testnet.

FerrosBFT: a 2-phase pipelined BFT protocol built on HotStuff-2. O(n) happy path. Immediate-propose pipeline. No hand-waving on safety.

<1s
Finality
2 consecutive QCs = committed (~800ms at 400ms slots)
1,800
Blocks / Second
Sustained on 3-validator testnet (M3 Max)
21K
TPS (Measured)
Full pipeline: mempool → execute → state root → sign → commit

Immediate-Propose Pipeline

Leaders propose immediately on QC/TC receipt — no waiting for timeout intervals. The pipeline is self-sustaining: each committed block triggers the next proposal at network speed.

Eliminates 400ms per-view wait. Block production limited by network propagation, not timers.

2-Phase Commit Rule

Finality requires 2 consecutive Quorum Certificates from ≥67% of validators. No single QC is treated as final. Provably safe under partial synchrony with f < n/3 Byzantine validators.

1 QC = fast confirmation (~400ms) for UX. Only commit rule = safety guarantee.

Retrospective Recovery

When a validator receives timeout messages for a view it already passed, it contributes its own timeout to help form a Timeout Certificate. Prevents deadlocks when validators join late or miss proposals.

View timeout: 400ms base, 3.2s cap with exponential backoff.

Slashing & Anti-Censorship

Equivocation (double-voting) = full slash, provable on-chain. Missed slots = reputation penalty only. Proposer rotation + mandatory mempool utilization prevents sustained censorship.

7 genesis validators → 19 steady state. 100K FRS minimum stake per validator.
☑

Testnet Verified

3 validators with rotating leaders producing identical block hashes at blocks 100, 1,000, and 5,000. Stablecoin gas collection, fee distribution, and the full consensus pipeline are running end-to-end. 312 tests passing, zero warnings.

Not a casino that occasionally produces useful technology.

A platform where useful technology is the point — and the economics reward everyone who makes it work.

Read the Whitepaper Start Building