Waqf Core protocol
An open protocol for verifiable waqf registries. Any institution — a nazir organization, a SIRC, a national awqāf board — runs their own registry on their own infrastructure. Every registry anchors into the same neutral spine: Bitcoin, which none of them control. Records verify anywhere, trusting only mathematics.
Operators operate; mathematics audits. This matches the fiqh of awqāf — an accountable nazir is required — while making silent tampering detectable by the world. Not a token. Not a coin. A record format and four rules.
§1 The record
A waqf's history is an append-only sequence. Records are never updated or deleted — corrections are new records.
| Field | Meaning |
|---|---|
| waqf_id | UUID of the waqf |
| seq | Position in the chain (1 = genesis creation) |
| event_type | One of 22 standardized events — deed_registered, trustee_appointed, lease_signed, distribution_made, court_ruling, annual_report… |
| payload | JSON event data |
| prev_hash | Hash of the previous record ("" at genesis) |
| recorded_at | UTC timestamp, microseconds |
| hash | The chain hash (§2) |
§2 Chain hash — tamper evidence
hash = SHA-256_hex(
waqf_id | seq | event_type | payload_text | prev_hash |
recorded_at as 'YYYY-MM-DDTHH:MI:SS.USZ' (UTC)
)A chain is valid iff every recomputed hash matches and every prev_hash links to the previous record. Editing any historical record breaks every hash after it.
§3 Signatures — attestation
signed_hash = SHA-256( canonical_JSON(payload) ) // sorted keys, no whitespace
signature = Ed25519.sign(signed_hash, secret_key)Roles: founder · witness · trustee · court · auditor · regulator. Keys are generated and held by the signers — never by the operator. Signatures cover the payload alone, so they are portable: a signature made by one implementation verifies in every other (the TypeScript and Python reference implementations are byte-for-byte compatible).
§4 Merkle batching
Unbatched records' chain hashes become leaves (ordered by time), paired with SHA-256 up to a single root; odd levels duplicate their last node. Any single record gets an inclusion proof — a sibling path a verifier recomputes locally, leaf to root.
§5 Bitcoin anchoring
The root is submitted to independent OpenTimestamps calendar servers, which commit it into a Bitcoin transaction. Within hours the proof upgrades to a Bitcoin block attestation, verifiable with the official OTS tooling. From that moment every batched record is timestamped in world history, outside any operator's control. Cost: pennies per batch, regardless of how many records it contains — this is how one protocol can carry a trillion dollars of assets for ~$50 a year of anchoring.
Live example: the reference registry's current root is committed in Bitcoin block 957,269.
§6 Verification — trust nothing
# audit any waqf on your own machine
npx waqf-verify <waqf-id>
✓ chain linkage ✓ merkle inclusion
✓ bitcoin anchor ✓ ed25519 signaturesFour tiers, each independently checkable: chain → signatures → Merkle inclusion → Bitcoin. Private waqfs expose only hashes; anchoring publicly commits their existence and timing without revealing content.
§7 Federation — how this decentralizes
Nobody runs the server; every institution runs a server — like email. Multiple conforming registries, operated by different awqāf bodies in different countries, all anchor into the same Bitcoin. The protocol is the standard; Bitcoin is the neutral spine; the reference implementation is open source. Adoption means running it yourself, not trusting us.