A Partition-Tolerant Settlement Protocol and the Case for a Unified Off-World Currency. Leo Tervit.
Abstract. Every settlement system in use today depends on continuous connectivity. Clearing, payment processing, and distributed consensus all assume that participants can reach a shared view of state within a bounded delay, and all of them stall when the network stays partitioned for long enough. That assumption holds on Earth and fails in space. A settlement on Mars sits four to twenty-four minutes from Earth at the speed of light and loses contact entirely for roughly two weeks during each solar conjunction, so any money that has to reach Earth in order to settle would stop working at precisely the moment it is needed most. This paper describes a settlement protocol built for that condition. It remains available during arbitrary network partition and reconciles to a single consistent ledger, with no possibility of double-spend across the partition, once the link returns. The design combines conflict-free replicated account state, region-local ordering on a directed acyclic graph, and a pre-committed escrow rule that makes spending the same value twice across a partition structurally impossible rather than merely unlikely. The paper also argues that an off-world economy should adopt one planet-wide currency rather than a patchwork of Earth-aligned national currencies or a direct dependence on Bitcoin, and it sets out a unit of account backed by trust and network demand instead of by any sovereign or any physical commodity. The same protocol runs across four scales, from a disconnected ship on Earth to a constellation of relay satellites in Mars orbit, with the partition growing longer at each step.
Every payment system in operation shares one hidden dependency: connectivity. Card networks, real-time gross settlement systems, and public blockchains all assume that participants can, within some bounded delay, converge on a common view of who owns what. When that assumption holds, the central problems of money are tractable. Double-spend can be prevented, transactions can be ordered, and balances can be made final. When the assumption fails, settlement stops.
For most of history this dependency was invisible, because the network rarely split for long. That is no longer a safe simplification. A growing set of economically meaningful environments is defined by disconnection rather than connection. Vessels and submarines operate beyond line of sight. Tactical and disaster-zone networks lose their links under stress. Polar and remote stations sit at the end of intermittent satellite hops. Looking further out, satellites lose mutual visibility as their orbits carry them past the horizon, lunar operations are occulted by the far side, and a Mars settlement is separated from Earth by a one-way light delay of four to twenty-four minutes and, every twenty-six months or so, by a complete communications blackout of about two weeks during solar conjunction.
In these settings a partition is not a fault that better engineering will remove. It is a property of the medium, fixed by geometry and the speed of light. A monetary system that halts whenever the link drops is not merely inconvenient in such an environment; for an economy that has to keep running while cut off, it is unusable. Two questions follow, and this paper addresses both.
The first is a systems question. Can a settlement protocol stay fully available during an arbitrary network partition and then reconcile to a single consistent ledger, provably free of double-spend, once the partition heals? The second is a monetary question that the first one forces into view. If an off-world economy cannot rely on Earth to settle, what should it use for money, and how should that money hold its value without a central bank, without a peg to any national currency, and without a redeemable physical commodity behind it?
The contribution of this paper is a single design that answers both. Section 2 sets the technical and economic background. Section 3 gives the system and adversary model. Section 4 presents the protocol, whose core is an escrow rule that removes cross-partition double-spend by construction. Section 5 makes the case for a unified planetary currency over the two obvious alternatives, fragmented national currencies and a direct dependence on existing cryptocurrencies. Section 6 specifies how the unit of account is constituted and why it is stable. Section 7 describes how the same protocol operates across four physical scales, from Earth to Mars orbit.
The instinct that a currency independent of Earth must be backed by something physical, energy, water, or oxygen, rests on a misunderstanding of how existing money works. Modern fiat currency is not commodity-backed. It is backed by trust, sustained by a state's ability to demand it in taxes and to enforce contracts written in it. On this view money is a transferable record of obligations rather than a claim on a warehouse. That distinction matters here, because it means a currency can be backed by credible, rule-bound trust and by genuine demand for its use, without any physical commodity standing behind it. Section 6 builds the monetary design on exactly this foundation.
Bitcoin secures its ledger by having nodes converge on the longest valid chain [1]. The mechanism is robust against many failures, but it degrades under sustained partition: a split network produces competing histories, convergence is only eventual and probabilistic, and the transactions on the shorter branch are discarded on reconnection. Discarding a region's transactions is acceptable for a global cryptocurrency tolerating brief forks, and unacceptable for settlement that has to be final the moment it happens locally. Classical Byzantine fault-tolerant protocols reach fast finality but require a connected, largely synchronous quorum, so they make no progress at all while the quorum is split. Ethereum generalised the chain into a programmable platform [2] and inherited the same connectivity assumption. None of these systems is designed to keep settling on both sides of a two-week blackout and then merge cleanly.
The reason this is hard, rather than merely unimplemented, is captured by the CAP theorem. Brewer conjectured, and Gilbert and Lynch proved, that a distributed system cannot at the same time guarantee consistency, availability, and partition tolerance; under a partition, one of consistency or availability has to give [3]. For an off-world economy, giving up availability is not an option, since a settlement cannot stop transacting for two weeks. The protocol in this paper therefore chooses availability during a partition and recovers a single consistent global view only after reconnection. The work is in arranging that the temporary inconsistency can never turn into monetary loss or into inflation beyond a known bound.
Communicating across long and intermittent delays is a solved problem at the transport layer. Delay- and disruption-tolerant networking, developed for the interplanetary internet, replaces end-to-end sessions with store-carry-and-forward custody transfer, in which each node holds a message until it can pass it on [4, 5]. This protocol does not reinvent that layer. It is designed to sit on top of it, treating the Bundle Protocol as the substrate that carries ledger updates across the gaps while the settlement logic above decides what those updates mean for balances.
A conflict-free replicated data type is a structure whose replicas can be updated independently and then merged into the same result regardless of the order in which updates arrive, because the merge operation is commutative, associative, and idempotent [6]. That is the right representation for account state that has to be updated separately in disconnected regions and then combined when they reconnect. The ledger here is built from such structures, with causal order established by version vectors in the style of Lamport's logical clocks [7], so that ordering never depends on a synchronised wall clock. No common clock spans a planetary partition, so logical time is the only kind available.
Several projects have connected blockchains to space, and they are useful both as evidence of demand and as a map of what remains unsolved. Marscoin, running since 2014 and supported by the Mars Society, identified the core constraints early: a four-to-twenty-four-minute delay rules out Earth-dependent banking, a Mars node tracking Bitcoin would always sit minutes behind Earth's chain tip and be exposed to reorganisation, and a settlement needs a currency of its own rather than an extension of Earth's [11]. Its own design, however, is a conventional single-chain proof-of-work currency, which forks rather than reconciles when a region is isolated for weeks. In industry, J.P. Morgan's Kinexys group built a prototype that executed a tokenised value transfer directly between two satellites in low Earth orbit, with the on-orbit ledger syncing to the ground only when a satellite came back into range, pointing toward a peer-to-peer marketplace in which satellites pay each other without an Earth intermediary [9]. Spacecoin relayed a signed blockchain transaction through space between Chile and Portugal as a proof of concept for a censorship-resistant communications backbone [10]. The pattern across all of them is consistent. The vision of off-world money is well populated, and the specific consensus problem that off-world money requires, settlement that survives a long partition and reconciles without double-spend, is not yet solved. That problem is the subject of this paper.
The network is modelled as a changing set of nodes grouped into regions. A region is a set of nodes that, under normal conditions, can communicate within a bounded delay: a ship, a station, a satellite cluster, or the full orbital constellation of a planet. Regions nest by physical locality, from a single locality such as a ship or a habitat, up to a body such as Earth, the Moon, or Mars, up to the interplanetary level that spans bodies. Partitions occur along the natural seams of this hierarchy. Some are short, such as a satellite dropping below the horizon. Others are long and predictable, such as a planet passing behind the Sun. The model places no upper bound on how long a partition lasts, so the protocol never assumes the link will return by any deadline.
There is no global clock. Each node has a local clock whose offset from others is unknown, and no synchronised time spans a partition. All ordering is logical and is carried by version vectors. The familiar quantities of latency and blackout are treated uniformly as partitions that differ only in duration.
Nodes may fail in arbitrary, Byzantine ways: they may crash, send conflicting messages, or collude. The economically decisive attack is the cross-partition double-spend, in which an account holder spends the same value in two or more regions that cannot see each other, betting that no single region can detect the conflict before it finalises. A secondary attack is partition-time over-issuance, in which a faulty region mints beyond its mandate while isolated. The design has to either prevent each of these outright or make it detectable and attributable once regions reconnect. Standard cryptographic assumptions hold for signatures and hashes, and each region is assumed to run an honest supermajority among its local validators.
The protocol has three layers: a ledger model based on replicated account state, region-local consensus for fast finality inside a connected region, and a reconciliation procedure for merging regions when they reconnect. The escrow rule in Section 4.3 is what ties these together into a sound monetary system.
Each account is represented not by a single mutable number but by a growing, hash-linked set of signed transaction records, in effect a small directed acyclic graph per account. The balance is a deterministic function of replaying that set. Because the structure is a conflict-free replicated data type, two replicas of the same account updated independently in different regions can always be merged by taking the union of their records, with version vectors establishing causal order and marking any concurrency. The consequence is that all correct replicas which have seen the same set of updates compute exactly the same state, no matter what order the updates arrived in. Convergence is a property of the data structure rather than something the network has to coordinate.
Inside a connected region, a lightweight Byzantine fault-tolerant protocol over a directed acyclic graph gives the region a local total order and local finality among its validators. While a region is internally connected, the CAP trade-off does not bite, because the region has both consistency and availability for transactions among its own members. This is the ordinary case: a ship's crew transacting with each other, or a colony running its internal economy. It is fast and final, and it is where most activity lives.
The difficult case is value that crosses a partition. The approach taken here is to refuse to let a partition create ambiguity in the first place. Each account is domiciled in exactly one home region, which is authoritative for its balance. To be able to spend in another region while partitioned, an account must, before the partition, move a bounded, region-scoped escrow credit into that region, and the home region holds back the amount escrowed. A region honours a foreign account's spending only up to the credit that was provably allocated to it.
Invariant 1 (No cross-partition overspend). Let an account $a$ hold balance $\mathrm{bal}(a)$ at the moment a partition divides the network into regions $R = \{r_1, \ldots, r_k\}$, and let $\mathrm{credit}(a, r_i)$ be the escrow that $a$ committed to region $r_i$ in advance. The protocol enforces $$\sum_{i=1}^{k} \mathrm{credit}(a, r_i) \le \mathrm{bal}(a), \qquad \text{and} \qquad \mathrm{spend}(a, r_i) \le \mathrm{credit}(a, r_i) \text{ for every } i.$$ The total that $a$ can spend across all regions during the partition is therefore at most $\mathrm{bal}(a)$, and spending the same value in two regions is impossible unless some region behaves faultily.
Invariant 1 changes the nature of the double-spend problem. On a connectivity-assuming chain, preventing double-spend is a race that the protocol tries to win probabilistically. Here there is simply no unallocated value left to spend a second time, so for correct regions the attack cannot occur. The price of this guarantee is a usability constraint: capacity to spend in a foreign region has to be positioned ahead of time. That constraint maps naturally onto how disconnected operations already work, since an operator provisions what it will need before it goes dark, and it is the deliberate cost paid in exchange for a guarantee that holds no matter how long the partition lasts.
The constraint is also lighter than it first appears, because several mechanisms reduce or remove the need for manual action while leaving Invariant 1 intact. In the ordinary case an account keeps a standing allowance in each region it uses regularly, replenished automatically from its home region whenever the link is up, so routine spending positions itself with no intervention; the invariant still holds because the standing allowances sum to at most the home balance at any partition boundary. The hardest partition is also the most predictable, since a solar conjunction's timing is known years ahead, so capacity can be pre-positioned on a schedule before each conjunction and sized from observed demand, while only unpredictable partitions such as a ship losing signal rely on the standing allowance. Within a region, transactions among local members net against one another during a partition, so only net cross-region exposure draws on escrow, and a region whose internal trade roughly balances consumes very little. A region that exhausts its allocation mid-partition need not halt either: it can keep transacting against locally issued, collateralised reconciliation credit that settles on reconnect, which turns a hard stop into a bounded, accountable counterparty risk rather than a failure of safety. How much such credit to allow is a policy parameter, not a weakening of the guarantee, because the resulting obligations remain visible and attributable when regions merge.
When regions reconnect, their replicas merge by union and the version vectors reveal any concurrency. For correct regions, Invariant 1 guarantees that no monetary conflict can arise. If a faulty or colluding region has honoured spending beyond its allocated credit, the conflict surfaces during the merge, because the held-back home balance and the foreign spending fail to reconcile, and it is attributable to the region that allowed it. Resolution is deterministic. A fixed total order over the pair (region identifier, transaction hash) selects the surviving transaction, and the counterparty whose transaction is reversed receives an explicit on-ledger claim, a reconciliation debt, rather than suffering a silent loss. A conflict thus becomes an accountable liability instead of stolen value.
Monetary issuance is rate-limited within each region and bounded globally, so that even an isolated, adversarial region cannot inflate the supply beyond a known ceiling, and any breach appears as reconciliation debt against that region's stake. This keeps the global supply auditable at every moment despite the absence of a global view: $$S_{\text{global}}(t) \le S_0 + \sum_{r \in R} \kappa_r \, \Delta t_r,$$ where $\kappa_r$ is region $r$'s issuance-rate cap and $\Delta t_r$ is the time since it last reconciled. The bound holds even though no region can see the others' state.
The protocol above could in principle carry many currencies. It is worth setting out why an off-world economy should instead converge on a single planet-wide unit, and why that unit should be purpose-built rather than borrowed from Earth. There are two alternatives to argue against: a set of competing national currencies that reproduce Earth's blocs on Mars, and a direct dependence on Bitcoin or another existing cryptocurrency.
The economics of currency areas is well understood. Mundell's theory of optimum currency areas holds that the right domain for a single currency is set by the mobility of labour and capital and by how shocks are shared, not by political borders [8]. Independent currencies are useful when regions face different shocks and need their own exchange rate to adjust; a common currency is better when factors move freely across the area and shocks are felt in common. By those criteria an early Mars settlement is close to an ideal single-currency zone. It is one integrated labour and capital market, since everyone lives and works within a few linked habitats. Its shocks are shared rather than asymmetric, because a dust storm, a life-support failure, or a missed supply launch hits the whole settlement together. And there is no sub-population that would gain from devaluing against another. On these measures Mars fits the conditions for a single currency more cleanly than the Eurozone, whose difficulties come precisely from asymmetric shocks and limited labour mobility across its internal borders.
There is also the nature of money itself. Money is a coordination good, and its usefulness grows with the number of people who accept it. Splitting the money supply of a small settlement across rival national units would directly undercut the one property money most depends on, while loading a tiny economy with the deadweight cost of currency conversion, fragmented liquidity, and harder price discovery, costs it can least afford. Layered on top of the economics is a question of control. A single non-national unit prevents any one Earth power from exporting its monetary policy onto Mars, together with the seigniorage that issuing money confers. A settlement whose viability depends on cooperation has little reason to import Earth's monetary rivalries along with its currencies.
The other tempting shortcut is to skip the design problem and denominate the off-world economy in Bitcoin or a similar existing cryptocurrency. This fails on three counts.
The first is technical, and it is the same point the rest of this paper turns on. Bitcoin and standard chains assume connectivity. A Mars node cannot reach Earth's chain tip in less than the one-way delay, and during conjunction it cannot reach it at all for about two weeks, so it can neither extend nor agree with the canonical chain while isolated. A settlement denominated in Bitcoin would be unable to settle for the duration of every blackout. The Marscoin analysis makes the same observation from the other side, noting that a Mars Bitcoin node would always lag Earth and be open to reorganisation [11].
The second is monetary. Denominating Mars in Bitcoin imports Bitcoin's monetary conditions, which are set entirely by Earth-side markets and mining, and hands the resulting seigniorage to holders on Earth. Mars would have no influence over its own money supply. Worse, the unit's value would be discovered on Earth exchanges, so during a blackout the settlement would have no price reference for its own money at exactly the time it is cut off.
The third is that the independence on offer is partly an illusion. Bitcoin is decentralised, but in practice it is mined, held, priced, and regulated within Earth's economy. Choosing it as the unit of account trades a dependence on the dollar for a dependence on the Bitcoin market, and both are terrestrial. It does not deliver the Earth-independence that an off-world currency should have.
None of this makes Bitcoin useless to the design. It makes Bitcoin the wrong unit of account for Mars while leaving it available in a different role, as a neutral reserve asset held on Earth during the currency's early life. Section 6 uses it in exactly that role, and the distinction between a reserve asset and a unit of account is what keeps the two uses from conflicting.
Given the case above, the unit of account is a single planet-wide currency that is not pegged to any national money. What remains is to say where its value comes from.
As Section 2.1 set out, durable money is backed by trust and by demand, not by a commodity. Physical backing, a token redeemable for energy, water, or oxygen, is clean in principle but premature in practice, since it presupposes off-world production and redemption infrastructure that does not yet exist, and building redemption machinery against a physical layer that is not there would be an empty exercise. The currency is therefore backed the way durable money is actually backed, by trust made credible through transparent rules, by real demand for its use, and by a neutral reserve during its early life. Physical backing is left as a future possibility once off-world production exists, not as a requirement now.
The unit draws its value from three things working together. The first is settlement utility. It is the medium that the network settles in and the unit in which validators are paid for finality and reconciliation, so use of the protocol creates steady, non-speculative demand to hold and spend it. The second is a neutral reserve at the start. The protocol holds a Bitcoin reserve to anchor confidence and provide a redemption floor on Earth while the network is young. Bitcoin is the natural choice for this because it is the only hard, liquid asset issued by no government, which makes it the most defensible reserve for a currency whose whole premise is that it answers to no nation. The reserve is a bootstrap and not a permanent peg: Bitcoin cannot cross a multi-week partition, so it serves as an Earth-side confidence anchor while activity is Earth-centred, and the unit is designed to float on its own settlement utility as the network extends outward. The third is a bounded, rule-based supply. Issuance follows a transparent schedule and stays within the bounds described in Section 4.5 even across a blackout, which gives holders a credible and auditable money supply rather than one set by discretion.
A dollar placed in orbit is still the liability of a terrestrial central bank. It can be inflated or frozen by terrestrial policy, and it cannot settle across a blackout because its settlement runs through Earth. The currency described here differs on each of those points. It is no nation's liability, its supply follows a published rule rather than discretionary policy, and it finalises locally during a partition by construction. That is the concrete content of the phrase "not tied to Earth".
The same protocol runs at every scale. What changes from one to the next is only the length of the partition it has to survive. Each scale is a working system in its own right, not merely a step toward the next, which is what lets the design be exercised and relied upon on Earth long before anything leaves it.
| Stage | Setting | One-way delay | Cause and length of partition |
|---|---|---|---|
| 1. Earth | Ships, submarines, tactical and disaster networks, polar stations | milliseconds to seconds | Signal loss, jamming, or outage; minutes to days |
| 2. Low orbit | Settlement directly between satellites | milliseconds | Orbital geometry and the horizon; seconds to minutes |
| 3. Cislunar | Lunar surface and relay operations | about 1.3 seconds | Occultation by the far side; hours |
| 4. Mars | A colony synced to a Mars orbital constellation | 4 to 24 minutes | Solar conjunction; about two weeks every twenty-six months |
Stage 1: Earth. The first setting involves no space at all. It is settlement for disconnected and contested environments on Earth: defence and tactical networks, maritime and subsea operations, polar and remote research, and disaster response, where the parties have to keep transacting through a loss of communications and reconcile cleanly afterwards. This is the same partition-tolerant core that the later stages need, exercised where partitions are measured in minutes and days rather than weeks.
Stage 2: low orbit. Here the disconnected nodes are satellites that lose line of sight to one another as their orbits carry them apart, settling between themselves without routing through a ground station. The partitions are now physical orbital geometry rather than a metaphor, and the value of settling without an Earth intermediary becomes concrete. This is the regime that the inter-satellite transfer prototype pointed toward [9].
Stage 3: cislunar. At the Moon the one-way delay is about 1.3 seconds, with real partitions whenever a node passes behind the far side. The delay and the occultation are long enough to exercise reconciliation under conditions that rehearse Mars at a smaller scale, while traffic to and around the Moon is already growing.
Stage 4: Mars. At Mars the ledger does not live on the surface. It lives in the orbital constellation. Relay satellites already carry Martian data traffic, and they have the power and the full-surface line of sight to host the Martian subledger. Surface nodes sync to the constellation, which finalises Mars-local transactions on its own during an Earth blackout and reconciles with Earth's ledger once conjunction clears. The Martian economy is then a sovereign subledger physically resident at Mars that merges with Earth on a delay, with consensus among the orbiters standing in for a central bank that does not exist. This is the unified, Earth-independent currency of Section 5 realised as running infrastructure.
The cross-partition double-spend is removed by construction for correct regions through Invariant 1, and for faulty regions it is detected during reconciliation and converted into an accountable, slashable debt rather than silent theft. Partition-time over-issuance is held within a known ceiling by per-region issuance caps, with any breach surfacing as reconciliation debt against the offending region's stake, so the global supply stays auditable. Capture of a region's local validators is bounded in effect: each region requires an honest supermajority, and the exposure of any single account to a captured region is limited to the escrow that account explicitly positioned there, which caps the blast radius of a compromise.
The most serious practical risk is not cryptographic but infrastructural. Ground stations, and orbital-compute providers where compute is rented rather than owned, are points of control that could censor or halt a region. The mitigations are to use multiple providers and multiple ground stations, to rely on store-carry-and-forward routing so that no single relay sits on the critical path, and to treat any rented hardware as availability infrastructure rather than as the basis of a claim to be un-seizable. The honest claim for a deployment on rented hardware is partition tolerance and operational resilience, not physical un-seizability, and the design should not assert sovereignty it does not control.
Governance has to obey the same physics as settlement. A change to a protocol parameter or an upgrade cannot require a synchronous global vote, because no global view exists during a blackout. Governance is therefore partition-tolerant in the same way the ledger is: proposals finalise within a region and reconcile along the same merge path as transactions, and the parameters that affect safety can be changed only at the interplanetary level once regions have fully reconciled. This keeps governance available during a partition without allowing an isolated region to make a change that would be unsafe to merge.
The problem of money for an off-world economy is usually treated as a matter of branding. Treated instead as an engineering problem, it has a clear core: settlement that survives a partition, stays available while a region is cut off, reconciles to one ledger when contact returns, and never allows the same value to be spent twice across the gap. Solving that yields a protocol whose value does not depend on Mars at all, since it applies directly to the disconnected and contested environments that already exist on Earth, while remaining ready for the day a Martian settlement needs money of its own. Alongside the protocol, the economics point in one direction: a single planet-wide currency, neutral and Earth-independent, fits an off-world settlement better than a patchwork of national currencies or a borrowed dependence on Bitcoin. The same design serves a ship that has lost signal, a satellite past the horizon, and a colony behind the Sun, with only the length of the silence changing between them.