AnchorRegistry: On-Chain Provenance Registry

• AnchorRegistry is a blockchain registry that organizes artifact lineage as directed acyclic provenance trees with clear parent–child relationships.
• It employs a dual-layer commitment scheme derived from a single user secret to secure both tree identity and per-anchor initiation, addressing operator trust issues.
• The system integrates game-theoretic dispute resolution and contract-level integrity checks to mitigate tree poisoning and ensure verifiable, trustless registrations.

AnchorRegistry is an immutable on-chain provenance registry deployed on Base, an Ethereum L2, and presented as the concrete instantiation of a framework of “trustless provenance trees” for an operator-gated blockchain registry. Its purpose is to anchor artifact registrations and their parent–child derivation relations on chain while allowing a single privileged operator to submit all transactions on behalf of users, without requiring users to hold wallets or pay gas, and without making attribution depend on operator trust. The system combines a formal provenance-tree model, a dual-layer cryptographic commitment scheme, game-theoretic analysis of attribution disputes, and a three-part integrity model for “tree poisoning” attacks (Moore, 3 Apr 2026).

1. Formal provenance model

AnchorRegistry represents artifact lineage as formally defined provenance trees. A provenance tree is a directed acyclic graph

$\mathcal{T} = (V, E, \lambda)$

where $V$ is a finite set of artifact anchors, $E \subseteq V \times V$ is a set of directed parent$\to$child provenance edges, and $\lambda: V \to \mathcal{M}$ labels each node with metadata in a metadata space $\mathcal{M}$. Each tree has a unique root $r \in V$ with no incoming edges, and every node is reachable from $r$ (Moore, 3 Apr 2026).

Each node $v$ carries six named metadata components: $\mathsf{arId}(v)$, a globally unique artifact identifier; $V$0, an artifact type from a fixed taxonomy; $V$1, a SHA-256 hash of an artifact manifest; $V$2, a tree identity commitment; $V$3, a per-anchor initiation commitment; and $V$4, the parent’s $V$5, empty for the root. The registry is therefore not a flat timestamping service but a graph-structured provenance substrate in which derivation edges are first-class on-chain objects (Moore, 3 Apr 2026).

The implementation is specified in terms of seven structural properties, P1–P7. P1–P4—immutability, uniqueness of $V$6, ancestry integrity, and tree membership—are enforced on chain at the smart-contract level. P5–P7—reconstructibility, tree ownership, and per-anchor initiation proof—are achieved through commitment design and event layout. This division is central: structural well-formedness is contract-enforced, whereas attribution and ownership are cryptographically recoverable from public data plus a client-held secret (Moore, 3 Apr 2026).

2. Operator-gated system model and the operator trust problem

AnchorRegistry is explicitly operator-gated. Users authenticate and pay off chain, then generate a secret ownership token $V$7 client-side in the browser. Only whitelisted operator wallets may call the registration functions. Verifiers are any later parties assessing provenance, including lawyers, regulators, AI systems, and other users. Adversaries include external attackers and potentially malicious users (Moore, 3 Apr 2026).

The operator-gated design provides a usability property—users do not send transactions and do not pay gas—but introduces the operator trust problem. Because the operator is always the on-chain sender, the raw blockchain record cannot distinguish between a legitimate registration in which a user authorizes and initiates the action and the operator merely submits it, and a unilateral operator registration submitted without user authorization. In both cases, the registrant field in the Anchored event is the operator wallet. Without additional structure, the on-chain record alone cannot distinguish user-initiated registrations from unilateral operator actions (Moore, 3 Apr 2026).

This ambiguity creates a symmetric evidentiary problem. A malicious operator can fabricate content and claim that a user requested it, while a malicious user can claim that an honestly recorded anchor was created without consent. The paper formalizes this as a game $V$8 with User and Operator as players, and with strategy sets that include accuse versus silent for the user and register-legitimate versus register-unilateral for the operator. Under ambiguous evidence, false accusations and unilateral registrations are both plausible (Moore, 3 Apr 2026).

The adversarial model is standard PPT. The operator has contract-call capability within the onlyOperator gates, lacks access to user keys $V$9, and may attempt unilateral registrations or mislabeling, but cannot break hash preimage resistance. External attackers cannot call registration functions directly, can observe all events and metadata, and may try to attach to others’ trees or spoof identity, but still lack other users’ secret keys. The security assumptions are stated as preimage resistance for keccak256, key secrecy for $E \subseteq V \times V$0, unique artifact identifiers, and correct contract enforcement (Moore, 3 Apr 2026).

3. Dual-layer commitment scheme

The core construction is a dual-layer commitment scheme derived from a single client-side secret key $E \subseteq V \times V$1. From that key, users derive both a tree identity commitment for the root and a per-anchor initiation commitment for each registration. Let $E \subseteq V \times V$2 be the client-generated ownership token, let $E \subseteq V \times V$3 be the root anchor identifier, let $E \subseteq V \times V$4 be the $E \subseteq V \times V$5-th child anchor’s artifact identifier, and let $E \subseteq V \times V$6. The commitments are

$E \subseteq V \times V$7

for the tree identity, and

$E \subseteq V \times V$8

for the per-anchor initiation commitment (Moore, 3 Apr 2026).

These values are written into node metadata so that $E \subseteq V \times V$9 for all nodes in the tree, satisfying the tree-membership property, and $\to$0 for content anchors or $\to$1 for governance anchors. The commitment-enforcement rule requires content anchors to have non-zero $\to$2, while governance anchors must have zero. As a result, user content and operator governance are made cryptographically distinguishable on chain (Moore, 3 Apr 2026).

Three theorems organize the attribution logic. Theorem 1 states tree ownership: if a party presents $\to$3 such that $\to$4, then except with negligible probability that party knows the original secret $\to$5. Theorem 2 states per-anchor initiation: if a party presents $\to$6 such that $\to$7, that party is, with overwhelming probability, the initiator of that content anchor. Theorem 3 states governance separation: $\to$8 These results implement P6 and P7 while preserving an explicit content/governance boundary (Moore, 3 Apr 2026).

The dispute-resolution consequence is direct. If a user claims that the operator created a content anchor without authorization, two cases exist. If the user can produce $\to$9 satisfying $\lambda: V \to \mathcal{M}$0, then by Theorem 2 the user proves initiation and the accusation is self-incriminating. If the user cannot produce such a $\lambda: V \to \mathcal{M}$1, the accusation can succeed only by treating keccak256 preimage resistance as broken. The same logic constrains the operator: it cannot forge a user-content anchor that is later defensible in a challenge, because it never sees $\lambda: V \to \mathcal{M}$2 (Moore, 3 Apr 2026).

4. Game-theoretic mechanism design

AnchorRegistry is analyzed as a mechanism-design problem in which cryptographic rules are chosen so that honest behavior is each player’s best response. The paper describes a false-attribution game, an enterprise griefing game, and a “landlord–tenant” abstraction in which the user is the “tenant” with full agency over content anchors, the operator is the “landlord” limited to governance actions such as REVIEW, VOID, and AFFIRMED, and the smart contract is the “lease” that enforces those rights (Moore, 3 Apr 2026).

Under the dual-layer commitment scheme, attribution disputes reduce to a challenge: produce $\lambda: V \to \mathcal{M}$3 such that $\lambda: V \to \mathcal{M}$4, and optionally $\lambda: V \to \mathcal{M}$5. For the user, false accusation is strictly dominated: either producing $\lambda: V \to \mathcal{M}$6 proves authorship, or failing to produce $\lambda: V \to \mathcal{M}$7 reduces the claim to a denial of the underlying cryptographic assumption. For the operator, unilateral registration of user content is technically indefensible because it cannot satisfy later verification, and governance actions are visibly marked by $\lambda: V \to \mathcal{M}$8. The mechanism therefore converts evidentiary ambiguity into a challenge-response structure with asymmetric failure modes for dishonest play (Moore, 3 Apr 2026).

The formal equilibrium claim is explicit. Proposition $\lambda: V \to \mathcal{M}$9 states that under the dual-layer commitment scheme, the unique Nash equilibrium is the honest equilibrium in which users initiate only registrations they intend to make, and the operator registers only user-authorized content and legitimate governance actions. Deviations are either cryptographically impossible or self-defeating because they are exposed by verification (Moore, 3 Apr 2026).

This equilibrium claim is narrower than a general trustlessness claim about every system component. It is a claim about attribution incentives under specific axioms: preimage resistance, key secrecy, unique IDs, operator gating, and commitment enforcement. The registry therefore does not eliminate all trust assumptions; it relocates them into explicit cryptographic and contract-level assumptions (Moore, 3 Apr 2026).

5. Tree poisoning and provenance-tree integrity

Beyond single-anchor attribution, AnchorRegistry addresses “tree poisoning”: attacks on the integrity of entire provenance trees. The paper distinguishes three attack variants. Fraudulent root registration occurs when an adversary registers a fake root and attempts to claim priority over a legitimate tree. Malicious child attachment occurs when an adversary attaches a child to a legitimate node by naming that node’s $\mathcal{M}$0 as parent. Tree identity spoofing occurs when an adversary observes a legitimate treeId and attempts to create new anchors that appear to belong to the same tree (Moore, 3 Apr 2026).

The integrity model requires three distinct mechanisms. First, cryptographic priority closes fraudulent roots. Distinct roots and keys yield distinct tree identities,

$\mathcal{M}$1

so legitimate and fraudulent trees are distinguishable, and blockchain timestamps determine which root was first on chain. Second, governance cascade closes malicious child attachments. Such attachments are permissionless by design, because provenance behaves like citation: an actor may declare derivation without the parent owner’s consent. The mitigation is therefore not prevention but suppression through VOID governance anchors, which mark the root of a malicious subtree so that off-chain indexes hide all descendants of the voided node from public views while leaving the on-chain history immutable. Third, contract enforcement closes tree identity spoofing through onlyOperator gating and commitment consistency checks (Moore, 3 Apr 2026).

The necessity result is also explicit. Proposition $\mathcal{M}$2 states that cryptographic priority, governance cascade, and contract enforcement are necessary and sufficient to close all three poisoning variants, and that no single mechanism is enough. Without cryptographic priority, fraudulent and legitimate roots may be indistinguishable; without VOID cascade, malicious attachments remain publicly entangled with legitimate trees; without enforcement, spoofed members could be registered into another user’s tree (Moore, 3 Apr 2026).

A common misconception is that arbitrary child attachment is itself a flaw in the provenance model. The paper rejects that premise. Permissionless attachment is described as intentional, because provenance assertions are analogous to citation claims. The integrity objective is therefore selective suppression and unambiguous attribution, not cryptographic prohibition of every downstream lineage claim (Moore, 3 Apr 2026).

6. Contract architecture, event design, and reconstruction

The deployed system is implemented as AnchorRegistry.sol on Base L2. The contract supports 23 artifact types across 8 groups and exposes three registration entry points: registerContent, registerGated, and registerTargeted. Registration is controlled by a 6-key architecture with an onlyOperator gate, and key changes use a 7-day timelocked recovery mechanism (Moore, 3 Apr 2026).

On-chain state is deliberately minimal. The contract uses mappings such as registered[arId] to enforce uniqueness and tokenCommitments[arId] to store per-anchor commitments. The primary representation of the registry is event-based: the Anchored event carries the full metadata necessary for reconstruction, including indexed arId and treeId, non-indexed arIdPlain and treeIdPlain, parent identifier, manifest hash, and tokenCommitment. The indexed topics support efficient eth_getLogs queries by artifact or tree, while the plain fields make reconstruction independent of any off-chain database (Moore, 3 Apr 2026).

Registration functions validate ancestry integrity by requiring registered[parentArId] == true for non-root nodes, validate uniqueness by requiring !registered[arId], and enforce the commitment rule by requiring tokenCommitment != 0 for content. Once recorded, anchors cannot be changed or deleted. Governance operations such as VOID, REVIEW, and AFFIRMED append new anchors rather than mutating prior ones. The result is an append-only, immutable registry in which structural updates are additive and historical states remain inspectable (Moore, 3 Apr 2026).

The reconstructibility property P5 states that given the contract address and deploy block number, the complete graph $\mathcal{M}$3 is recoverable from the public blockchain event log in $\mathcal{M}$4 time with no off-chain infrastructure. Reconstruction proceeds by fetching all Anchored events, parsing each event into a node, adding a parent edge whenever parentArId is non-empty, and partitioning nodes by treeId. The paper also describes a trustless verification routine in the anchorregistry Python package, authenticate_tree(ownership_token = K, root_ar_id = R), which checks both $\mathcal{M}$5 and $\mathcal{M}$6 across all content anchors in the tree (Moore, 3 Apr 2026).

7. Data substrate, scalability, comparisons, and limitations

A later paper isolates the data-structural substrate underlying AnchorRegistry as a Parent-Hash DAG (PHDAG), defined by a globally unique identifier, a parent reference, and a manifest commitment, with append implemented by a constant number of storage writes to previously untouched slots. That work formalizes PHDAG append as $\mathcal{M}$7 in gas cost, proves trustless reconstruction from public event logs in linear time, and reports depth-invariant empirical cost on Base Sepolia: PHDAG root append is observed at $\mathcal{M}$8 gas with standard deviation about $\mathcal{M}$9 gas, whereas an incremental Merkle tree grows linearly with depth and crosses over only around depth $r \in V$0–$r \in V$1 under the paper’s models and measurements (Moore et al., 8 Jun 2026). In the AnchorRegistry paper itself, the additional cost attributed to the dual-commitment layer is summarized as approximately $r \in V$2 gas per registration, still $r \in V$3 and invariant to registry scale (Moore, 3 Apr 2026).

Within the paper’s own comparative framing, AnchorRegistry differs from timestamping systems such as OriginStamp and Bernstein because those systems provide proof of existence but do not address per-artifact initiation, operator trust in gated settings, provenance trees, or tree poisoning. It differs from NFT systems because NFTs focus on transferable token ownership, require users to hold cryptocurrency and sign transactions, and do not model provenance trees or operator-gated UX. It differs from Decentralized Identifiers because DIDs solve identity rather than artifact lineage and do not define per-artifact initiation proofs or the operator-gated submission problem (Moore, 3 Apr 2026).

The system’s guarantees are bounded by explicit assumptions. Security depends on keccak256 preimage resistance, user-side secrecy of $r \in V$4, global uniqueness of registration identifiers, correct enforcement of commitment rules by the deployed bytecode, and sound Base L2 consensus and data availability. Residual trust remains in governance actions, because VOID, REVIEW, and AFFIRMED decisions are under operator control even though they are cryptographically distinguishable from user content. Key management is also critical: loss of $r \in V$5 prevents later proof of tree ownership or initiation, even though the historical data remain on chain (Moore, 3 Apr 2026).

Taken together, these results define AnchorRegistry as a provenance-specific blockchain registry in which usability and attribution are intentionally separated. The operator may retain transaction-submission authority, but tree ownership, per-anchor initiation, tree reconstruction, and poisoning resistance are assigned to public logs, contract enforcement, and client-side commitments rather than to operator testimony (Moore, 3 Apr 2026).