PoW Design: Argon2id and 10-Second Blocks
Exfer's mining algorithm is Argon2id — every hash attempt reads and writes 64 MiB of memory. The parameter is chosen at a deliberate sweet spot: small enough that a laptop can mine, large enough that an ASIC farm does not pay off.
Argon2id is the password-hashing function selected by the 2015 Password Hashing Competition and standardized in RFC 9106. Using it for proof-of-work (PoW) is what makes Exfer mining CPU-friendly.
For mining parameters and throughput numbers, see How Exfer mining works. This page explains why these parameters were chosen and how they compare to other PoW chains.
Memory-hard PoW: why not SHA-256
Bitcoin uses SHA-256 — pure compute, essentially no memory pressure. The result: ASICs have a ~10⁴× speed advantage over general-purpose CPUs. Mining quickly becomes the game of a few large farms; the participation barrier is hundreds of thousands of dollars in dedicated hardware.
Memory-hard algorithms reverse this: every hash attempt must read and write a large block of RAM. ASICs aren't dramatically faster at that — what determines throughput is memory bandwidth, and the hardware cost of memory bandwidth is roughly the same for everyone. The ASIC advantage shrinks; commodity devices can participate.
Why 64 MiB is the sweet spot
Argon2id's memory cost is configurable; Exfer picked m = 64 MiB. This number sits at the intersection of four constraints:
| Constraint | Why 64 MiB works |
|---|---|
| Larger than a GPU's per-core memory | GPUs split VRAM across thousands of cores; per-core slices are small, so 64 MiB defeats GPU parallelism |
| Tractable on a CPU | A laptop with 8 GB RAM can run 100+ concurrent attempts |
| Bad ROI for ASICs | Fabricating a chip with 64 MiB of high-bandwidth on-die memory is expensive, with only modest speedup |
| Even a Raspberry Pi can do it | Pi 5 single-threaded: 1–3 attempts/sec — slow but feasible |
The other parameters — t = 2 (two iterations) and p = 1 (single lane) — are the standard performance/security balance recommended by RFC 9106 for password hashing.
10-second blocks: why not 1, why not 10 minutes
- 10 minutes (Bitcoin): tolerable for human-driven transfers, too slow for autonomous programs — an AI calling an API can't wait 10 minutes
- 1 second (ultra-fast chains): network propagation latency is ~100ms; 1-second blocks produce lots of forks, orphans, and uncertainty
- 10 seconds: propagation latency is under 5% of the block time, confirmations are deterministic; "seconds" is fast enough for programs
Difficulty retargets every 4 320 blocks (~12 hours) to keep the average around 10 seconds.
Comparison with other PoW chains
| Chain | PoW algorithm | Memory cost | Block time | ASIC situation |
|---|---|---|---|---|
| Bitcoin | SHA-256 | ~0 | 10 min | Fully ASIC-dominated |
| Litecoin | Scrypt | 128 KiB | 2.5 min | ASIC-dominated |
| Monero | RandomX (Monero's custom memory-hard PoW) | 2 GiB (with dataset) | 2 min | CPU-dominated since 2019 |
| Ethereum (PoW era) | Ethash | ~4 GiB | 13 sec | Long-term GPU-dominated |
| Exfer | Argon2id | 64 MiB / attempt | 10 sec | No ASICs today |
Monero is the most successful real-world test of the ASIC-resistance path. It has held the line through multiple algorithm changes since 2014, and RandomX (deployed in 2019) is still mined by hundreds of thousands of commodity machines worldwide. Exfer is in the same lineage, with lighter parameters (64 MiB vs. RandomX's 2 GiB), trading slightly weaker ASIC resistance for cheaper node-side verification.
Costs / boundaries
- Not absolutely ASIC-resistant. A purpose-built Argon2id ASIC is feasible in principle; it just doesn't pay off at Exfer's current scale. If Exfer's market value grew to tens of billions, someone might invest the R&D — at which point the community might need a soft fork to retune parameters (which is exactly what Monero has done historically)
- Node verification is more expensive. Validating a block with Argon2id is much slower than SHA-256 because of the memory-bandwidth cost. On underpowered hardware, sync is slower. This is most noticeable during initial sync with
--no-assume-valid - Absolute hash rate is far below SHA-256 chains. This is intrinsic to memory-hard PoW — fewer attempts per watt. The dollar cost of a 51% attack measured in absolute terms is lower, but relative to market value the picture is similar
Further reading
- How Exfer mining works — parameters, throughput estimates, reward curve (operational details)
- Solo mine on a CPU — actual commands
- Tokenomics and issuance curve — how PoW rewards are emitted over time
- Glossary / Argon2id — one-line definition