Listen Get

Earth Optimization Protocol: Technical Specification

Identity, Pooling, Settlement, and Oracle Design for Interoperable Outcome Prizes

Author
Affiliation

Mike P. Sinn

Institute for Accelerated Medicine

Abstract

The Earth Optimization Prize138 is a dominant assurance contract that rewards humanity for increasing global median health and wealth above verified thresholds. Depositors get their money back plus interest if the metrics are not met (making participation a dominant strategy regardless of outcome); if global median healthy life years and global median real after-tax income improve, the treasury releases to verified participants proportionally. Registration asks two questions: yes/no on the 1% treaty (the concrete political demand) and how much military vs. clinical trials (with cross-jurisdictional evidence from Optimitron). The mechanism is designed for interoperability: independently operated pools commit to the same two terminal metrics and automatically form a single reward network.

This paper specifies the six protocol-level capabilities that interoperability requires: (1) a cross-pool identity layer providing one-person-one-vote guarantees via proof-of-personhood; (2) a permissionless pool registry that makes metric commitments verifiable; (3) VOTE and PRIZE token mechanics with defined minting rules and payout triggers; (4) direct cross-pool claims where any verified voter can claim from any pool; (5) tamper-evident scoreboard aggregation so every front-end displays the same coalition-wide totals; and (6) a terminal metric oracle combining institutional data with decentralized surveys to trigger treasury release. The goal is a protocol simple enough that a second pool can launch without coordinating with the first.

Keywords

outcome prizes, dominant assurance contract, proof-of-personhood, pool interoperability, oracle design, mechanism design, decentralized surveys

61.1 Introduction

The Earth Optimization Prize138 is a dominant assurance contract that rewards humanity for increasing global median health and wealth. Two terminal metrics define success: global median healthy life years (HALY) and global median real after-tax income. Depositors get their money back plus interest if the metrics are not met, so participation is a dominant strategy regardless of whether the prize succeeds. If the metrics improve above verified thresholds, the treasury releases to participants proportionally.

Registration asks two questions:

  1. Yes or no on the 1% treaty139. “Should 1% of military spending be redirected to clinical trials?” Binary, concrete, the specific political demand that politicians can act on. This produces the VOTE token (claim eligibility) and the scoreboard headcount (political pressure). The 1% treaty is also the thing that IABs140 fund the lobbying campaign for, so the voter count directly feeds the financial instrument’s value.

  2. How much military vs. clinical trials? The core reallocation question, shown with Optimitron141 evidence: cost per DALY for military spending vs. clinical trials, lives saved per dollar, economic returns per dollar. The voter sees the data and picks an allocation. The aggregate result from millions of people is a global citizen preferred split between war and medicine, generated by the evidence-informed wishocratic mechanism the book proposes142. The user does not need to understand “wishocracy” or “Optimitron” as concepts. They see what each dollar buys in each category and choose how to split it.

Broader wishocratic allocation across all spending categories (education, infrastructure, research, defense, etc.) is available as optional deeper engagement after registration, but these two questions are the minimum viable referendum.

Downstream use of registration data. Aggregate results from both questions are published as global citizen preferences: the total headcount for and against the 1% treaty, and the population-weighted preferred allocation between military and clinical trials. This data is publicly available to any front-end, campaign, or policymaker. The headcount is the political pressure; the allocation data is the citizen mandate.

The mechanism paper demonstrates that independently operated pools sharing these metrics are complements rather than competitors: every new pool increases the combined reward visible to every voter. That argument assumes six capabilities that do not yet exist:

  1. A person verified in one pool cannot re-register in another (identity layer).
  2. Any pool committing to the standard metrics is automatically interoperable (pool registry).
  3. VOTE and PRIZE tokens have defined rules that work across pool boundaries (token mechanics).
  4. A verified voter can claim their share from any pool directly (cross-pool claims).
  5. Every front-end displays the same combined voter count and pool size (scoreboard aggregation).
  6. Treasury release is triggered by independently verified welfare improvements (terminal metric oracle).

This paper specifies each. The design constraint throughout is minimizing coordination: a second pool should be able to launch without asking the first pool’s permission.

61.2 Identity Layer

61.2.1 Problem

The prize grants one vote per person. Without cross-pool deduplication, a person could register in the Japan pool, the EU pool, and the Gates Foundation pool, claiming three shares of the combined treasury. At scale, Sybil attacks would transfer wealth from legitimate voters to attackers and destroy the proportional-claiming guarantee that makes interoperability work.

61.2.2 Requirements

The identity layer must provide three properties:

  • Liveness. The registrant is a real person, not a bot, deepfake, or synthetic identity.
  • Uniqueness. The registrant has not already registered in any participating pool.
  • Privacy. The pool learns “this is a unique human who has not registered elsewhere,” not “this is Alice Chen from Osaka.”

61.2.3 Existing Approaches

World ID (Worldcoin/Tools for Humanity). Iris biometrics hashed into a zero-knowledge proof. Strong uniqueness and privacy. Concerns: hardware dependency (requires Orb scans), centralized enrollment infrastructure, jurisdictional bans.

BrightID. Social-graph-based uniqueness. No biometrics; participants attend verification parties where existing members vouch for new ones. Lower uniqueness guarantees (colluding vouchers can create fake identities). Better decentralization.

Proof of Humanity (Kleros). Video submission plus vouching, adjudicated by Kleros courts on disputes. More decentralized than World ID, weaker liveness guarantees, slower onboarding.

Government ID. Strong liveness and uniqueness within one country. Cross-country deduplication is unsolved. Privacy is poor.

61.2.4 Minimum Specification

The protocol does not mandate a specific identity provider. It defines an identity attestation interface that any provider can implement:

Attestation {
  unique_human_root: bytes32    // Provider-specific unique identifier hash
  provider_id: string           // Which identity system issued this
  liveness_timestamp: uint64    // When liveness was last verified
  zk_proof: bytes               // Zero-knowledge proof of uniqueness
}

A pool accepts an attestation if:

  1. The provider_id is on the registry’s approved provider list (see §3).
  2. The zk_proof verifies against the provider’s public verification key.
  3. The unique_human_root does not appear in the global nullifier set (a shared append-only log of hashes representing registered humans, without revealing which human maps to which hash).

The global nullifier set is the critical shared state. It must be append-only, publicly auditable, and accept entries from any participating pool. A Merkle tree published on a public blockchain or a federated append-only log both satisfy these requirements.

Liveness decay. An attestation expires after 12 months. Voters must re-verify annually to remain eligible for claims. This prevents deceased or fabricated identities from accumulating perpetual shares.

Sybil via multiple providers. If a person verifies with World ID in Pool A and BrightID in Pool B, they get two entries. Mitigation: the protocol should launch with a single approved provider and add cross-provider bridging as providers develop interop standards.

Coercion. An employer or government forces citizens to register and surrender their VOTE tokens. Mitigation: coercion to vote a particular way is already illegal in every democracy. The registration headcount matters more than which way any individual votes; the exposure to evidence during registration is what shifts preferences. Transferable tokens incentivize voluntary recruitment, which is the primary bottleneck (pluralistic ignorance).

61.3 Pool Registry

61.3.1 Problem

The prize paper claims that any pool committing to the same metrics “automatically joins the reward network.” This requires a public record where pools declare their metric commitments and where anyone can verify those commitments. Without a registry, “same metrics” is a verbal promise, and interoperability requires bilateral agreements between every pair of pools.

61.3.2 Data Model

Each registry entry contains:

Field Type Description
pool_id bytes32 Unique identifier (hash of creation transaction or registration event)
operator string Human-readable name of the operating entity
metric_commitments string[] Must be exactly ["median_haly", "median_real_income"] for interoperability
treasury_address address On-chain address or auditable account holding pool funds
treasury_balance_attestation bytes Signed attestation of current balance (updated periodically)
identity_providers string[] Which proof-of-personhood providers this pool accepts
registration_timestamp uint64 When the pool joined the registry
status enum active, suspended, deregistered

61.3.3 Registration

Permissionless. Any entity can register a pool by submitting the data model fields and posting a minimum treasury deposit (prevents spam). The registry enforces one hard constraint: metric_commitments must exactly match the canonical set. A pool that measures “GDP per capita” instead of “median real income” is not interoperable and cannot register. This is the mechanism that turns metric alignment from social convention into protocol constraint.

61.3.4 Balance Attestation

Pools must update their treasury_balance_attestation at least monthly. For on-chain treasuries, this is automatic (the balance is publicly readable). For off-chain treasuries (bank accounts, endowment funds), the pool must provide a signed attestation from an approved auditor or custodian. A pool whose attestation is more than 90 days stale is automatically flagged as suspended and excluded from the scoreboard.

61.3.5 Disputes

If evidence emerges that a pool is reporting fraudulent balances or has been compromised, any participant can file a dispute. The protocol should support at least one dispute resolution mechanism (e.g., a bonded challenge where the challenger posts a stake, and a panel of pool operators or independent arbitrators adjudicates). Disputed pools are flagged but not immediately suspended, to prevent griefing attacks.

61.3.6 Implementation Options

On-chain registry. A smart contract on a public blockchain. Permissionless, censorship-resistant, globally accessible. Gas costs and blockchain dependency.

DNS-like federation. Each pool publishes a standardized JSON file at a well-known URL (e.g., /.well-known/earth-optimization-pool.json). Aggregators crawl and index these files. No blockchain dependency, but requires trusted aggregators.

The protocol should specify the data model and validation rules, not the implementation layer. Either approach works if it provides permissionless registration, public auditability, and enforced metric constraints.

61.4 Token Mechanics

61.4.1 Overview

The prize mechanism uses two token types:

  • VOTE tokens represent verified support for the outcome. They determine claim eligibility when the treasury releases.
  • PRIZE tokens represent deposits into the prize pool. They are the dominant assurance contract: claims on the treasury that return principal plus interest on failure.

These are protocol primitives. Other instruments (bonds, revenue-share contracts, campaign financing vehicles) are tools that contestants or supporters might use to cause implementation. They are outside the scope of this protocol.

61.4.2 VOTE Tokens

What the vote means. A VOTE token represents two things: (1) a verified human counted in the coalition demanding the 1% treaty, and (2) a claim on the prize pool if global median health and wealth improve. Registration includes the 1% treaty referendum (yes/no) and the military-vs-clinical-trials allocation (with Optimitron evidence). The VOTE token is minted on completion of both questions.

Minting. One VOTE token is minted when a person completes proof-of-personhood verification, answers the two registration questions, and registers with a participating pool. One person, one token, across all pools. The token is minted by the registration pool but recognized by all pools via the global nullifier set.

Transferable. VOTE tokens are transferable with secondary market pricing. One person, one token minted (one-person-one-vote at issuance), but tokens can be sold after minting. The secondary market price is a real-time signal of what coalition membership is worth, which incentivizes recruitment. A dead voter’s token is burned on liveness expiry. Coercion (forcing someone to register and surrender their token) is already illegal in every democracy; transferability incentivizes voluntary recruitment, which is the primary bottleneck.

Expiry. VOTE tokens expire when the underlying identity attestation expires (12 months). Holders must re-verify annually. Expired tokens are excluded from claim calculations.

61.4.3 PRIZE Tokens

Minting. PRIZE tokens are minted when a depositor sends funds to a participating pool’s treasury. One PRIZE token per unit of currency deposited.

On failure (the dominant assurance guarantee). If the terminal metrics are not met by the prize deadline (or after a depositor-specified lock-up period), the depositor redeems PRIZE tokens for their original deposit plus accrued interest. This is what makes participation a dominant strategy: you are better off depositing than not, regardless of whether the prize succeeds.

Where the interest comes from. During the lock-up period, the treasury is invested in low-risk, liquid instruments: government bonds (US Treasuries, sovereign debt from AAA-rated countries), money market funds, or equivalent. The pool operator (or a designated custodian) manages these investments. The investment policy is published in the pool’s registry entry so depositors can evaluate risk before depositing. The interest rate is whatever the underlying instruments yield, not a promised rate. If the underlying instruments lose value, depositors may receive less than their original principal; the dominant assurance guarantee covers the deposit plus accrued interest, not a guaranteed minimum return. In practice, the investment policy (government bonds, money market funds) makes principal loss unlikely but not impossible. The protocol requires that treasury investments be (1) liquid enough to honor redemptions within 30 days and (2) published transparently so depositors and auditors can verify the treasury’s real value.

On success. When the terminal metric oracle triggers treasury release, PRIZE token deposits are distributed to VOTE holders. Each verified voter can claim an equal share from each pool (see §5). PRIZE tokens are burned. The depositor’s principal is gone; it has been redistributed to the people who caused the outcome.

Recruiter attribution. Individual pools may offer recruitment bonuses (e.g., a share of the pool’s own allocation to voters who bring in new registrants). This is a pool-level marketing decision, not a protocol requirement. The protocol tracks only the one-person-one-vote base layer.

61.5 Cross-Pool Claims

61.5.1 Problem

Voter V registered in Pool A. Pools A, B, and C all hold treasury funds. When the oracle triggers release, V must be able to claim from all three pools, not just Pool A.

61.5.2 Direct Claims (No Netting)

Each pool independently divides its treasury by \(N\) (total unique verified voters across all pools) and allows any verified voter to claim:

\[ \text{claim from pool } p = \frac{T_p}{N} \]

The voter visits each pool (or a front-end that aggregates claims), proves they are a verified unique human via their identity attestation, and collects \(T_p / N\) from each pool. The voter’s total payout is:

\[ \text{total}_i = \sum_{p \in \text{pools}} \frac{T_p}{N} = \frac{1}{N} \sum_{p \in \text{pools}} T_p \]

No inter-pool fund transfers. No netting. No settlement window. Each pool manages its own treasury and pays out independently. The only shared state is \(N\) (the global voter count from the nullifier set) and the identity attestation that proves the claimant is one of those \(N\) people.

61.5.3 Why This Works

Since every voter gets the same share (\(1/N\)) from each pool, and each pool knows its own \(T_p\) and can read \(N\) from the global nullifier set, every pool can pay out independently. The voter’s total is identical. The only coordination is agreeing on \(N\), which the identity layer already provides.

61.5.4 Graduated Release

The oracle may trigger partial releases as metrics improve incrementally (e.g., 10% of each pool’s treasury when median HALY improves by +0.5 years). Each pool applies the same release percentage to its own treasury. No cross-pool coordination needed beyond the shared oracle trigger.

61.5.5 Failure Modes

Pool goes offline. The voter cannot claim from that pool. Their claims from all other pools are unaffected. The offline pool’s treasury is held until the operator resurfaces or a dispute mechanism releases it to depositors.

Pool is undercapitalized. If a pool’s actual treasury is less than attested, it pays out what it has. The pool operator is flagged for fraud via the registry dispute mechanism (§3). Other pools are unaffected.

61.6 Scoreboard Aggregation

61.6.1 Problem

The prize mechanism’s political power comes from a single number: the combined size of the coalition (voters plus money). If front-ends display only their own pool’s numbers, the coalition looks fragmented. Every front-end must display the same global totals.

61.6.2 Data

The scoreboard aggregates two numbers:

  • Combined voter count. The number of unique verified humans across all participating pools. Deduplicated via the global nullifier set (a person registered in two pools counts once).
  • Combined pool size. The sum of all attested treasury balances across all participating pools.

61.6.3 API Specification

Every participating pool exposes a standardized endpoint:

GET /.well-known/earth-optimization-pool/status

Response {
  pool_id: bytes32,
  voter_count: uint64,
  voter_nullifiers_root: bytes32,
  treasury_balance: uint256,
  attestation_timestamp: uint64,
  signature: bytes
}

An aggregator (run by anyone) queries all registered pools, computes the union of nullifier sets, and publishes:

GET /api/scoreboard

Response {
  total_unique_voters: uint64,
  total_pool_size_usd: uint256,
  pool_count: uint32,
  pools: [ { pool_id, voter_count, treasury_balance, status } ],
  computed_at: uint64
}

Any front-end can query any aggregator (or run its own) to display the global totals. Since the computation is deterministic (given the same pool status responses), any two honest aggregators produce identical results. Front-ends can query several and flag discrepancies.

61.6.4 Tamper Evidence

Inflated voter count. A pool publishes its nullifier Merkle root. Auditors can request the full nullifier set and verify each entry against the identity provider’s records. Pools that refuse are flagged as suspended.

Inflated treasury balance. For on-chain treasuries, the balance is independently verifiable. For off-chain treasuries, the attestation must come from an approved auditor. The protocol should move toward requiring on-chain proof-of-reserves over time.

Pool status endpoints should update at least daily. Aggregators should recompute at least every hour. The scoreboard is a political tool (showing coalition size), not a financial ticker.

61.7 Terminal Metric Oracle

61.7.1 Problem

The entire mechanism depends on a single trigger: did global median HALY and global median real after-tax income actually improve? If this measurement is wrong, gameable, or disputed, the treasury either releases when it should not (rewarding failure) or refuses to release when it should (punishing success). Oracle design is the credibility bottleneck of the entire system.

61.7.2 What Is Measured

Global median healthy life years (HALY). The median number of years a person born anywhere on Earth can expect to live in full health, as measured by the WHO’s Health-Adjusted Life Expectancy methodology or equivalent. This is not life expectancy (which counts years lived in poor health). It is the quality-adjusted metric. Global, not per-country: the prize rewards improving the species-level number, not cherry-picking which countries count.

Global median real after-tax income. The global median household’s annual disposable income after taxes and transfers, adjusted for purchasing power parity and inflation. Source: World Bank, OECD, or equivalent global data aggregators.

61.7.3 Who Measures

Institutional data. WHO, World Bank, and OECD already publish global HALY and income figures with established methodologies. The oracle accepts their published figures directly. These are the most-measured numbers on Earth. The oracle’s primary job is reading an annual report, not building novel measurement infrastructure.

Decentralized surveys. Institutional data has two weaknesses: it lags by 1-3 years, and it depends on national statistical offices with uneven quality. The protocol should also support decentralized surveys collected by the same verified voter base. The identity layer already provides a global network of verified humans. Periodic health and income surveys (phone-based, app-based, or integrated into the voter re-verification process) would provide an independent, near-real-time data source that does not depend on any government or institution. This is not a replacement for institutional data; it is a cross-check and a gap-filler for countries with weak statistical infrastructure. Over time, as the voter base grows, decentralized survey data may become more comprehensive than institutional sources for the specific metrics the prize cares about.

Dispute resolution. If an institutional report is contested (e.g., evidence that a national statistical office inflated its figures, affecting the global aggregate), any participant can file a dispute by posting a bond. An independent academic panel reviews the evidence and issues a binding ruling. If the challenger wins, the report is rejected and the provider must resubmit corrected data; the challenger’s bond is returned plus a reward. If the challenger loses, the bond is forfeited.

61.7.4 Trigger Thresholds

The protocol supports graduated release rather than binary all-or-nothing:

Improvement in Global Median HALY Treasury Released
Baseline established (year 0) 0%
+0.5 years sustained for 3 years 10%
+1.0 years sustained for 3 years 25%
+2.0 years sustained for 5 years 50%
+5.0 years sustained for 5 years 100%

Equivalent thresholds for median real income (e.g., +5% sustained for 3 years triggers 10%). Both metrics must improve for release; improvement in only one triggers nothing. This prevents gaming by, for example, increasing income through policies that reduce health.

The “sustained for N years” requirement prevents short-term manipulation (a temporary measurement anomaly or methodology change could spike the numbers for one reporting period, then revert).

61.7.5 Gaming Resistance

Methodology changes. The WHO or World Bank could change how HALY or income is calculated, producing apparent improvement without real change. Mitigation: the protocol locks measurement methodology at baseline. Any methodology change requires re-baselining, which resets the improvement clock.

Selective reporting. Data providers could exclude unhealthy or poor subpopulations from global aggregates. Mitigation: decentralized survey cross-checks using the voter base, plus independent data sources (hospital records, insurance claims, mortality registries, satellite-derived economic indicators).

Coverage gaps. Global medians depend on data from countries with weak statistical infrastructure. Mitigation: the protocol specifies minimum population coverage (e.g., data must represent at least 80% of the global population). Improvements measured from a partial sample do not trigger release. Decentralized surveys help fill coverage gaps where institutional data is thin.

61.8 Implementation Roadmap

61.8.1 Phase 1: Single Pool

State. One canonical pool with proof-of-personhood registration and a single treasury. No interoperability needed because there is only one pool.

Deliverables. Identity attestation interface (§2), VOTE and PRIZE token contracts (§4), basic scoreboard (just one pool’s numbers), manual oracle reporting (Tier 1 institutional data published by the pool operator with a dispute email address), treasury invested in government bonds with published investment policy.

Success criterion. 10,000+ verified voters, treasury > $1M.

61.8.2 Phase 2: Pool Registry + Cross-Pool Identity

State. A second pool launches. The registry and cross-pool identity recognition become necessary.

Deliverables. Pool registry (§3), global nullifier set for cross-pool deduplication (§2), aggregated scoreboard (§6) showing combined totals from both pools. Direct cross-pool claims (§5) enabled (any voter claims from any pool).

Success criterion. 2+ pools operating independently, scoreboard showing combined voter count and treasury, at least one cross-pool claim executed.

61.8.3 Phase 3: Decentralized Surveys

State. The voter base is large enough to produce statistically meaningful survey data.

Deliverables. Periodic health and income surveys integrated into the voter re-verification process (§7). Survey data published alongside institutional data for cross-checking. Graduated release thresholds activated.

Success criterion. Survey data covering 50+ countries, correlation with institutional data above 0.9 for overlapping populations.

Each phase can operate without the subsequent phases. A single pool with manual oracle reporting is a functional (if centralized) prize. Each phase removes a centralization dependency and makes the mechanism harder to capture, corrupt, or shut down.