HELIOSTAR PROTOCOL

Heliostar Token
(HOT) White Paper

Draft v0.4 · July 2026 · English Edition

A transparent token issuance and NFT-license mining architecture for the Heliostar ecosystem, designed around deterministic allocation, on-chain verifiability, bounded monetary policy, and non-custodial participation.

Status notice. This document specifies the current protocol design, including participation-adjusted issuance, transfer-locked mining enrollment, and a Token-2022 target for Mainnet HOT. The current Devnet HOT is an active Token-2022 test asset and is not evidence that the Mainnet Mint exists. The exact first-emission time, audited enrollment-program address, initial 100 million HOT allocation and vesting, Mainnet program addresses, and legal framework remain deployment-gated parameters. They are not final until separately approved, audited, and published.

01 · ABSTRACT

Protocol thesis

Heliostar Token (HOT) is the proposed freely transferable utility and reward asset of the Heliostar ecosystem, specified for issuance on Solana Mainnet under the Token-2022 standard. Its monetary policy is deliberately bounded: lifetime issuance cannot exceed one billion HOT, burns never recreate mint capacity, and mining terminates after the 900 million HOT mining budget has been exhausted. Weekly issuance is participation-adjusted rather than fixed. It contracts when little eligible Star Power is actively enrolled and expands gradually—subject to a hard weekly ceiling—when participation becomes broad.

The architecture separates authority from automation. A server may act as a permissionless keeper, snapshot indexer, and distribution publisher, but it must not hold unrestricted mint authority. Consensus-critical constraints belong in an audited Solana program; the website and API are read models derived from finalized on-chain state.

02 · TOKEN STANDARD AND ASSET CLASSIFICATION

Token-2022 utility, separate from RWA claims

Mainnet HOT is specified for Solana Token-2022 (Token Extensions) as an ecosystem utility token for mining rewards, transfers, swaps, product redemption, and verifiable burns. The current Devnet HOT is an active Token-2022 test asset used to validate the same token-program boundary before Mainnet deployment. The official Mainnet Mint and its enabled extension set must be published and independently verified on-chain before they are treated as deployed facts.

HOT does not represent title to a physical asset, beneficial ownership, revenue participation, collateral, or a contractual redemption claim. Adopting Token-2022 is a technical standard choice; it does not by itself turn HOT into a real-world-asset token.

Heliostar RWA Series

Any future Heliostar real-world-asset initiative will use a separate Heliostar RWA Series Mint for each defined asset or program. Each issuance must independently disclose its legal rights, issuer, custody model, valuation source, transfer restrictions, redemption terms, authorities, and risk factors. Heliostar Wallet is designed to support HOT and verified Heliostar RWA Series assets without combining their supply, authorities, accounting, or disclosures.

03 · MONETARY PARAMETERS

Bounded issuance

Symbol: HOT
Decimals: 6
Lifetime cap: 1,000,000,000 HOT
Initial issuance: 100,000,000 HOT
Mining allocation: 900,000,000 HOT
Base weekly issuance: 1,000,000 HOT
Weekly issuance range: 0–1,250,000 HOT
Target participation: 50%
Upward smoothing: 25% of weekly increase
Unissued carryover: None
Additional active-NFT bonus: 0.3% of one average active NFT · max 100
Mining start: Confirmed once by the operator and publicly disclosed before activation

Let M_max denote the lifetime issuance cap, M₀ the one-time initial issuance, E_t the actual issuance in epoch t, and G = 900,000,000 HOT the mining allocation. Duration is supply-first and therefore variable; 900 epochs is the nominal duration only when every epoch issues the one-million-HOT base amount.

M_t = min(M_max, M₀ + Σ_k=1^t E_k)

1,000,000,000 = 100,000,000 + 900,000,000

The protocol tracks lifetimeMinted independently from the SPL Mint’s current supply. This distinction is essential because token burns reduce current supply but must not reopen the issuance budget.

S_t = M_t − B_t, C_t = M_max − M_t

Here S_t is current supply, B_t is cumulative finalized burn, and C_t is remaining mint capacity. Increasing B_t never increases C_t.

Figure 1 · Lifetime allocation. The 100 million HOT genesis issuance and 900 million HOT mining reserve reconcile exactly to the immutable one-billion-HOT lifetime cap.

04 · EMISSION CONTROL

Program-constrained mint authority

After genesis issuance, mint authority should be transferred to an audited HOT Emission Program-derived address (PDA). The program enforces cluster identity, start time, epoch cadence, published participation inputs, deterministic issuance math, one execution per epoch, monotonic lifetime issuance, the weekly ceiling, the mining-allocation ceiling, and terminal authority revocation.

The keeper submits a transaction; it does not decide the amount or participation ratio.
The program rejects premature, duplicate, oversized, mathematically inconsistent, or post-terminal emissions.
Each successful emission mints the exact calculated amount directly to the Reward Vault token account.
Unissued capacity is not automatically carried into a later epoch.
When cumulative mining issuance reaches 900 million HOT, mint authority is permanently revoked or rendered unreachable by immutable terminal state.

The operator is solely responsible for HOT, mining controls, Mining License NFTs, succession, and audited program upgrades. The server never possesses the operator key. Routine Epoch snapshots use a separate least-privilege HSM/KMS authority and require no manual wallet approval. The operator confirms the mining start once; the schedule and formula then become immutable. Operator replacement requires nomination by the current operator and acceptance by the successor. The company retains a separately controlled offline recovery copy.

05 · LICENSE-NFT MINING

Snapshot-based Star Power

Mining License NFTs are not sold by the protocol or through the wallet. An authorized operator issues them and allocates them to eligible users without payment. For epoch t, define 𝓛_t as all Mining License NFTs that satisfy official collection membership, finalized ownership, registry tier, active status, activation time, and expiry policy at snapshot slot σ_t. Undistributed operator inventory, foreign collections, unresolved registry records, suspended, burned, and expired licenses are excluded.

The protocol accepts exactly eight ordered Star Power levels. The Tier identifier is the one-based index of the selected level, preventing an issuer from pairing a Tier with an arbitrary power value.

𝓢 = {10,000; 30,000; 50,000; 100,000; 500,000; 1,000,000; 5,000,000; 10,000,000}, s_i,t ∈ 𝓢

Let 𝓐_t ⊆ 𝓛_t be licenses that completed the audited active-enrollment condition before the cutoff. “Active” requires both a publicly verifiable registry record and an asset-level transfer lock—not an app-open event or unverifiable server heartbeat.

Transferable ownership, locked participation

A license remains a user-owned, freely transferable Core Asset while it is not enrolled. Enrollment does not move the NFT into protocol custody. Every issued license is created with an asset-level Permanent Freeze Delegate whose authority is the enrollment-authority PDA. One owner-signed atomic transaction records enrollment and changes that permanent plugin's frozen state to true. Core rejects transfer and ordinary burn operations while the asset is frozen. Because the plugin can be installed only at asset creation and cannot be revoked by a later owner, the transfer lock cannot be bypassed by removing an owner-managed delegate. This mechanism follows the official Metaplex Core Permanent Freeze Delegate model.

TRANSFERABLE →^{enroll + freeze} ENROLLED_LOCKED →^{cancel + thaw} TRANSFERABLE

Cancellation is also atomic: it marks the registry record inactive for future snapshots and changes the same permanent plugin's frozen state to false in one transaction. A partial state—registered but unlocked, or locked but unregistered—is invalid and must fail closed. Transfer can be attempted only after the cancellation transaction is finalized. The Permanent Freeze Delegate persists across that transfer in the thawed state, so the recipient can later enroll without weakening protocol control; enrollment itself must still be explicitly owner-signed.

T_t = Σ_{i ∈ 𝓛ₜ} s_i,t A_t = Σ_{i ∈ 𝓐ₜ} s_i,t p_t = A_t / T_t

Participation increases are smoothed to 25% of the gap per epoch while decreases take effect immediately. This asymmetric filter limits short-lived enrollment spikes without allowing stale high participation to overpay a suddenly smaller active set.

p̂_t = p_t, if p_t ≤ p̂_t−1; otherwise p̂_t = p̂_t−1 + 0.25(p_t − p̂_t−1)

With target participation p₀ = 0.50 and maximum multiplier f_max = 1.25, the participation-adjusted issuance factor is:

f(p)=0, if p=0; f(p)=p/p₀, if 0<p≤p₀; f(p)=1+(f_max−1)(p−p₀)/(1−p₀), if p>p₀

E_t = min(1,000,000 · f(p̂_t), 1,250,000, G − Σ_k<tE_k)

Figure 2 · Participation-adjusted issuance curve. Issuance scales linearly to the one-million-HOT base at 50% effective participation, then grows more slowly to the 1.25-million-HOT weekly ceiling.

An enrolled license cannot transfer. If its owner cancels after σ_t, then transfers after the unlock is finalized, the already finalized epoch-t allocation remains attributed to the owner recorded at σ_t. The new owner may enroll for a later snapshot. Each asset address appears at most once in the canonical input set.

06 · DETERMINISTIC ALLOCATION

Base-unit conservation and dust

For wallet w, let A_w,t be summed raw Star Power and n_w,t its active-license count. Every enrolled official Mining License—including a promotion Mining License—contributes to both values under the same policy. Every additional active NFT adds 30 basis points (0.3%) of one average active NFT's Star Power, up to 100 additional NFTs. Using the average makes the result independent of NFT ordering when a wallet holds mixed Star Power tiers.

c_w,t = min(max(n_w,t − 1, 0), 100) b_w,t = 30c_w,t

W_w,t = A_w,t + ⌊A_w,tb_w,t / (n_w,t · 10,000)⌋ W_t = Σ_w∈Active W_w,t

R*_w,t = E_t · W_w,t / W_t

For equal 10,000-Star-Power licenses, two active NFTs produce a reward weight of 20,030; 101 produce 1,013,000. NFTs beyond the 100-additional-NFT cap still add their full raw Star Power but do not raise b_w,t above 3,000 basis points. Raw Star Power continues to determine participation and total epoch issuance; reward weight allocates only that already-fixed amount.

Figure 3 · Active-license count bonus level. The published bonus level rises linearly by 0.3 percentage points per additional active NFT and stops increasing after 100 additional NFTs.

All calculations use integer base units. Floating-point arithmetic is prohibited. If Q_t = E_t · 10^d is the actual epoch issuance in base units and d = 6, the provisional allocation is:

a_w,t = ⌊ Q_t · W_w,t / W_t ⌋

D_t = Q_t − Σ_w a_w,t, 0 ≤ D_t < |Wallets_t|

The remaining D_t base units are assigned by the largest-remainder method. Equal remainders are ordered by ascending raw wallet public-key bytes. Consequently, the published allocation conserves the emission exactly:

Σ_w Allocation_w,t = Q_t

The calculation version, canonical input ordering, snapshot file hash, source slot, and implementation hash are published for independent reproduction.

07 · MERKLE CLAIMS

Exact-epoch reward commitments

Each finalized epoch allocation is committed through a directional SHA-256 Merkle tree. A leaf binds one epoch, allocation index, wallet, and exact base-unit amount to the deployed Reward Program and Protocol Config.

leaf = SHA256("heliostar-claim-v1" ∥ program ∥ config ∥ epoch_u64le ∥ index_u32le ∥ wallet ∥ amount_u64le)

The Reward Program verifies the approved root, directional proof, claimant signer, Reward Vault identity, and epoch-specific replay bitmap before transfer. Each allocation index can be claimed once; successful claim state and token transfer are atomic.

08 · TOKEN ECONOMICS

Utility, distribution, and velocity

The 900 million HOT mining allocation creates a supply-bounded but duration-variable participation curve. At the one-million-HOT base, nominal annual gross issuance is approximately 52 million HOT and the mining reserve lasts 900 epochs. At the 1.25-million-HOT ceiling it lasts no fewer than 720 epochs; sustained participation below target extends the schedule.

Duration = 900,000,000 / average(E_t)

Annualized Gross Issuance_t ≈ 52 · E_t, 0 ≤ E_t ≤ 1,250,000 HOT

Figure 4 · Illustrative mining duration. Constant-participation scenarios show why 900 epochs is nominal rather than a hard maximum. Actual duration depends on the published effective participation history.

Economic sustainability depends on utility demand, reward claim behavior, license distribution, treasury policy, and product-redemption sinks—not solely on supply scarcity. The initial 100 million HOT allocation must be published as a complete allocation table with beneficiaries, purpose, vesting cliffs, linear-release schedules, custody model, and governance controls before Mainnet genesis. No allocation is implied by this draft.

Mining License NFTs represent eligibility and weight, not a promise of profit. Realized HOT value, exchangeability, product utility, taxation, and regulatory treatment may vary by jurisdiction.

09 · REDEMPTION AND BURN

Verified economic sinks

For future product redemption, HOT is first transferred to an order-specific escrow. Only after stock, payment finality, cancellation, and fulfillment policy checks does the escrow or program execute SPL Token BurnChecked. A transfer to an inaccessible “dead address” is not recognized as a protocol burn.

B_t+1 = B_t + burn_order, S_t+1 = M_t+1 − B_t+1

Each public burn record includes amount, mint, finalized signature, slot, timestamp, and a privacy-preserving order commitment. Immediate burn at checkout is avoided where consumer cancellation or refund obligations remain open.

10 · TRANSPARENCY LAYER

Reproducible public accounting

The public portal exposes lifetime minted, current supply, total burned, next emission, Reward Vault balance, total eligible Star Power, enrolled active Star Power, raw and effective participation ratios, issuance factor, actual epoch issuance, active license count, per-license enrollment/lock state, epoch allocations, claimed and unclaimed totals, snapshot slot, Merkle root, calculation version, and enrollment/cancellation transaction evidence.

On-chain finalized state is authoritative; API caches are not.
Missing configuration is represented as unavailable, never as zero.
Snapshot JSON and CSV remain downloadable and content-addressed.
Corrections are append-only and preserve the original value, reason, approval, and transaction evidence.
Mainnet and Devnet identities are explicit in every response and never inherited across clusters.

11 · SECURITY MODEL

Defense in depth

The protocol uses least authority, deterministic state transitions, fail-closed clients, device-protected operator signing for privileged actions, isolated HSM/KMS signing for routine epochs, offline recovery, primary and backup RPC providers, certificate pinning for owned APIs, bounded payloads, transaction simulation, confirmation reconciliation, and domain-separated signatures.

Before Mainnet activation, the emission, enrollment-lock, and Reward Vault programs require independent audit, property-based tests for issuance conservation and cap invariants, adversarial enrollment/cancellation/direct-transfer/pooling tests, atomicity tests that prohibit registry-lock divergence, deterministic fixed-point arithmetic tests, upgrade-authority review, incident runbooks, monitoring, reproducible builds, and a public bug-reporting channel.

12 · GOVERNANCE AND RISK

Operational accountability

The operator confirms the mining start timestamp exactly once. That transaction permanently locks the epoch duration, target participation, emission ceiling, smoothing, and the complete reward formula in a versioned on-chain policy account. No later proposal or activation path exists. Emergency pause and resume remain available, but skipped emissions are zero and never carried forward. The one-billion lifetime cap and all locked mining conditions therefore remain independently auditable throughout the protocol lifetime.

Material risks include smart-contract defects, key compromise, oracle or indexer inconsistency, RPC censorship, NFT registry errors, liquidity shocks, legal restrictions, consumer-protection obligations, and user key loss. Transparency reduces information asymmetry; it does not eliminate technical or market risk.

13 · DEPLOYMENT SEQUENCE

From Devnet to Mainnet

Freeze the exact issuance time, enrollment/cancellation instruction schema, snapshot cutoff, and initial-allocation vesting.
Implement the participation filter, issuance curve, registry, asset-level freeze/thaw CPI, snapshot, Merkle, claim, and burn components on Devnet using integer base units.
Simulate low participation, rapid growth, cancellation at the snapshot boundary, forbidden transfer while frozen, transfer after finalized thaw, pooling, final-epoch clipping, and zero-participant epochs.
Complete audits, invariant testing, threat modeling, and operational rehearsal.
Publish Mainnet addresses, authorities, policy parameters, build hashes, legal documents, and genesis allocation.
Transfer mint authority to the audited PDA, execute genesis issuance, and verify public accounting.
Activate weekly emissions only after website, API, keeper redundancy, alerting, and incident controls are live.

Disclaimer. This white paper is a technical design document, not investment, legal, tax, or financial advice. HOT availability and functionality depend on technical audit, operational readiness, and applicable law.