00
Program Summary
Consolidated budget and scope across all phases.
Total Engineering (Ph 1–10)
2,250–3,000
hours · typical ~2,500
Phase 1–10 Cost
$240K–$320K
core protocol build
Phase 11 Cross-Chain
$90K–$170K
900–1,400 hours
Security Audit
$40K–$80K
mandatory pre-mainnet
ICP Cycles / Ops
$15K–$30K
5-year operational burn
Recommended Budget
$385K–$600K
full project scope
T1
Development Partner & Team
the engineering team Blockchain SL — A Coruña, Spain.
the engineering team Blockchain SL
A Coruña, Spain · Founded 2019 · 15+ engineers · In-house team, no outsourcing
Rate: Spanish/EU team blended rate approximately $100–$115/hour. Competitive for a senior in-house Spanish blockchain studio. Rate should be confirmed in writing within the contract with a per-role breakdown.
Core Team Roles
Protocol Architect / Lead Engineer
Backend Engineer #1
Motoko / Rust / Canister dev
Motoko / Rust / Canister dev
Backend Engineer #2
Motoko / Rust / Canister dev
Motoko / Rust / Canister dev
Frontend Engineer
DevOps Engineer
Security Engineer
Part-time
Part-time
P1
Architecture Lock & System Design
Weeks 1–4 · Foundation before a single line of production code is written.
PHASE 1Architecture Lock & System Design
Work Includes
- translating economic model into deterministic protocol architecture
- defining system state machines
- defining canister layout
- designing capital pool segregation
- designing swap routing architecture
- defining sealing and Year 5 settlement sequencing
- defining failed-transaction refund logic (no early exit exists in canonical model)
Deliverables
- full architecture document
- canister interaction diagram
- deterministic invariant definitions
- engineering module specification
Oversight Controls
- milestone approval required before next phase
- architecture walkthrough meeting
- repository initialized and shared
- independent architecture review allowed
Payment Milestone10% of contract value
P2
Swap Intake Engine
Weeks 5–8 · Token conversion and capital routing.
PHASE 2Swap Intake Engine
Work Includes
- token intake mechanism
- ICP deposit intake
- asset whitelist logic
- token conversion routing
- transaction validation
- swap accounting ledger
- failure handling logic
Deliverables
- swap engine canister
- transaction ledger system
- capital routing module
Oversight Controls
- weekly engineering report required
- commit history visible in repository
- module demonstration at milestone review
Payment Milestone15% of contract value
P3
Capital Architecture Capital Engine
Weeks 9–13 · Core deterministic financial engine.
PHASE 3Capital Architecture Capital Engine
Core deterministic financial engine. Implements: Participant Pool and Operating Fee Reserve.
Work Includes
- capital pool accounting system
- capital segregation enforcement
- pool valuation tracking (ICP holdings × spot price, mark-to-market)
- treasury state machine
- deterministic routing logic
Deliverables
- capital engine canister
- treasury accounting layer
- pool isolation verification
Oversight Controls
- architecture verification meeting
- external code inspection permitted
- invariant testing demonstration
Payment Milestone20% of contract value
P4
BTC Allocation Engine
Weeks 14–17 · All Bitcoin allocation mechanics including the Founding Million draw.
PHASE 4BTC Allocation Engine
Work Includes
- VRF randomness system
- sealed allocation ledger
- daily VRF sealing logic — one slot sealed per 24 hours against full 10M-participant universe; results invisible until Year 5
- reveal sequencing system — all 2,100 sealed slots (275 founding + 1,825 daily) revealed simultaneously at Year 5
- Founding Million VRF draw — triggered on 1,000,000th participant confirmation
- cryptographic sealing of 275 winning wallets
- 1,000,000th participant registration monitor — automatic founding draw trigger
- simultaneous announcement and 1 BTC credit to all 2,100 winners at Year 5 settlement (under Scenario 3 only; if profit clears the BTC threshold)
- both-draw eligibility — founding-million participants are entered in both draws and may win in both; the founding draw and the daily draw are independent
- founding cohort registration counter — tracks fill progress toward 1,000,000th participant trigger
Deliverables
- randomness module
- BTC allocation registry
- sealed ledger structure
- Founding Million sealed draw canister
- founding cohort registration counter
- winner announcement and credit module
Oversight Controls
- security engineer review
- randomness verification tests
- deterministic allocation testing
Payment Milestone15% of contract value
P5
BTC Sealing & Year 5 Settlement Engine
Weeks 18–20 · Daily VRF sealing throughout the cycle, simultaneous reveal at Year 5.
PHASE 5BTC Sealing & Year 5 Settlement Engine
Implements the daily VRF sealing engine and the Year 5 settlement waterfall. Daily VRF sealings produce no payouts during the cycle — all 1,825 sealed daily-draw winners and the 275 sealed founding-draw winners are revealed and paid simultaneously at Year 5, conditional on the BTC threshold being cleared.
Execution Order
- 1. Daily VRF sealing — one slot sealed every 24 hours against the full 10M-participant universe; result committed on-chain immediately, invisible until Year 5
- 2. Founding draw VRF — sealed once, automatically, at the moment the 1,000,000th founding participant registers; 275 winning slots committed on-chain, invisible until Year 5
- 3. Year 5 settlement — Pool valued, profit calculated, BTC threshold tested, scenario determined, all VRF results revealed simultaneously, BTC purchased and credited if Scenario 3 applies, residual 80/20 split executed
Work Includes
- daily VRF sealing module — one slot per 24 hours, sealed against full participant universe from Day 1
- 275 BTC founding draw module — VRF-based winner selection at 1,000,000th-participant trigger
- sealed ledger management — cryptographic commitment, time-sealing, forward-linking
- Year 5 settlement waterfall — pool valuation, threshold test, scenario branching
- simultaneous reveal logic — all 2,100 sealed slots revealed in a single deterministic event
- unfilled-slot re-draw logic — any winning slot belonging to an unfilled position re-drawn against actual participants at Year 5
Deliverables
- daily VRF sealing canister
- founding draw VRF canister
- sealed ledger structure
- Year 5 settlement waterfall canister
- simultaneous reveal scheduler
Oversight Controls
- simulation tests validating sealing, threshold, and reveal logic across all three scenarios
- VRF determinism verification
- unit tests validating protocol invariants
Payment Milestone15% of contract value
P6
Failed-Transaction Refund & Year 5 Distribution Engine
Weeks 21–23 · Refunds for failed transactions; final Year 5 pro rata distribution payouts.
PHASE 6Failed-Transaction Refund & Year 5 Distribution Engine
There is no early exit, redemption, or mid-cycle refund mechanism. Every participant's $100 is committed for the full five-year cycle. This phase implements (a) refunds for failed pre-entry transactions only (failed conversions, KYC rejections, chargebacks) and (b) the Year 5 pro rata distribution payout mechanics that close the protocol.
Work Includes
- failed-conversion refund logic — tokens returned to originating wallet after retry exhaustion
- KYC-rejection refund logic — fiat returned within 5 business days
- chargeback handling — position freezing, manual review queue, position void on confirmed reversal
- Year 5 pro rata payout module — per-participant cash distribution at settlement
- BTC credit module — 1 BTC credited to each revealed VRF winner under Scenario 3
Deliverables
- failed-transaction refund module
- Year 5 distribution payout system
- distribution accounting ledger
Oversight Controls
- refund and distribution simulations required
- deterministic payout validation against canonical waterfall
Payment Milestone5% of contract value (carved from Phase 5)
P7
User Application (Dashboard)
Weeks 16–26 (parallel build) · Participant-facing interface.
PHASE 7User Application (Dashboard)
Features
- Internet Identity onboarding
- participant dashboard
- sealed-slot tracker (count of daily slots sealed to date)
- BTC sealing view (founding draw status, sealed daily-slot count, projected Year 5 outcome based on current Pool Value)
- refund status display (for failed pre-entry transactions only)
- lifecycle progress indicators
- Founding Million sealed draw status — founding cohort progress toward 1,000,000th participant
- winner announcement screen — simultaneous reveal of all 2,100 winners (275 founding + 1,825 daily) at Year 5 settlement, under Scenario 3
Deliverables
- responsive web application
- participant dashboard
- backend API integration
Oversight Controls
- UI preview milestones
- functionality demonstration
Payment Milestone13% of contract value
P9
Fiat On-Ramp Integration
Weeks 22–25 · Payment provider and fiat deposit routing.
PHASE 9Fiat On-Ramp Integration
Work Includes
- payment provider integration
- fiat deposit routing
- fraud detection checks
- conversion into ICP
Deliverables
- payment integration module
- deposit validation system
Oversight Controls
- transaction testing
- payment provider sandbox validation
Payment Milestone2% of contract value (carved from Phase 7)
P10
Infrastructure, Testing & Deployment
Weeks 24–28 · Final deployment and mandatory security audit.
PHASE 10Infrastructure, Testing & Deployment
Work Includes
- deployment pipelines
- monitoring system
- logging and diagnostics
- infrastructure automation
- system load testing
Deliverables
- deployment scripts
- monitoring dashboard
- infrastructure documentation
- ICP cycles provisioning (est. $15K–$30K operational burn)
Security Audit — Mandatory: Independent smart contract security audit required prior to mainnet deployment. Recommended providers: OtterSec (ICP-specialist), Halborn, or Trail of Bits. Estimated cost: $40,000–$80,000. Separate budget line, not included in the engineering contract.
Oversight Controls: Full system simulation · performance stress testing · independent security review.
Payment Milestone5% final payment upon successful deployment
GOV
Development Governance Requirements
Operational controls and oversight framework across the full program.
Weekly Engineering Reports
- hours worked
- modules developed
- repository commits
- blockers encountered
- next week objectives
Repository Transparency
- full repository access
- continuous commit visibility
- permanent code ownership transfer
Independent Code Review Rights
- AI-assisted code review permitted
- external engineering audits permitted
- static security analysis allowed
Scope & Termination Controls
- all scope changes require written approval
- missed milestones beyond 30 days permit contract termination with code retention
SEC
Build Integrity & Audit
Counterparty controls, third-party audit, witnessed deployment, and post-launch monitoring. Scope and budget impact across the build program.
The protocol settles deterministically and irreversibly on-chain. Once the production canister is locked, the rules are whatever the deployed code says they are — for five years. The controls below are the standard practices on a serious build of this size and the founder considers all of them non-negotiable. They are documented here so that scope, cost and process are unambiguous from contract signature.
Repository Discipline
- Read access for the founder and one nominated independent reviewer from week one
- GPG-signed commits required; anonymous and shared-account commits rejected
- Branch protection: no force-pushes, no history rewrites on release branches
- Two-person merge rule for all release-branch merges; second reviewer not from the same vendor
- Permanent commit graph; no tag movements after publication
Deterministic Builds
- Production canister WASM byte-for-byte reproducible from any clean checkout of the named commit
- Each release candidate ships with: commit hash, build environment, expected SHA-256, reproduction instructions
- Reproducibility is an acceptance criterion for promotion
Hardcoded Address Verification
- Destination addresses (participant pool, Performance Fee, charity, marketing) are double-blind verified character-by-character against founder-supplied source
- Verification performed twice with at least 24 hours between attempts
- Each destination wallet exercised before lockdown: test transaction in, test transaction out, by the named recipient
- Performance Fee receiving wallet is a multi-signature wallet; signing arrangements are off-protocol but the address is encoded by the engineering team
Witnessed Deployment Ceremony
- Deployment performed in a recorded session
- Attendees: engineering lead, founder representative, third-party auditor, one independent observer
- Local WASM SHA-256 verified against on-chain canister hash before controller removal
- Recording retained as part of the audit record
Pre-Lockdown End-to-End Test
- 10–100 test participants pay a fraction of real entry value into the production canister, mainnet, mutable
- Every distribution code path runs against the test cohort with auditor observing
- Test repeated at least twice; only the exact passing commit is eligible for promotion
- One-line changes between test pass and promotion invalidate the test and audit
Engagement Letter Terms
- Defined liability cap negotiated in writing
- Warranty: no developer has included undocumented code paths in the production canister
- Disclosure of all subcontractors and third-party contributors with commit access
- Obligation to cooperate fully with the third-party audit
Third-Party Audit and Monitoring — Separate Budget
The build is not "complete" on Blockchain SL's certification alone. An independent third-party audit is contracted directly by the founder, not the engineering team. Audit and monitoring sit on a separate budget line, outside the engineering build totals, but are listed here so the full launch cost is visible.
| Item | Provider Tier | Estimated Cost | Timing |
|---|---|---|---|
| Independent security audit | Trail of Bits, NCC Group, Halborn, OpenZeppelin (or equivalent ICP-experienced firm) | $80K–$250K (one-off) | Pre-launch, against named commit |
| Witnessed deployment | Combined: engineering lead + auditor + observer | Included in audit fee | Launch day |
| Continuous on-chain monitoring | TRM Labs, Chainalysis KYT, or equivalent | $20K–$60K per year | From launch through Year 5 settlement |
| Post-launch incident retainer | Audit firm, on-call | $15K–$40K per year | From launch through Year 5 settlement |
Indicative ranges only; actual quotations to be obtained from named providers ahead of contract signature. Five-year cumulative external security cost: roughly $255K–$750K, separate from the Blockchain SL engineering budget.
Engineering team scope confirmation. The engineering team is not the audited party in the formal sense — Blockchain SL is responsible for delivering build artifacts, supporting the audit, and participating in the deployment ceremony. The audit firm has unrestricted read access to the repository for the duration of the engagement; this access is granted, not negotiated, and predates contract signature.
∑
Phase 1–10 Engineering Totals
Core protocol build summary.
| Metric | Value |
|---|---|
| Total Engineering Hours | 2,250–3,000 hours |
| Typical Expectation | ~2,500 hours |
| Estimated Cost | $240K–$320K |
Phase 11 Note: The Phase 11 cost range ($90K–$170K) represents an 89% spread and should be treated as provisional. A refined estimate will be produced once Phase 3 architecture is locked and validated. The engineering team to provide an updated Phase 11 estimate at Phase 3 milestone review.
P11
Cross-Chain Wallet Integration
Phase 2 Expansion — post-launch. 10–14 weeks · 900–1,400 hours · $90K–$170K.
Build Window
10–14 weeks
post protocol deployment
Estimated Hours
900–1,400
six sub-phases
Estimated Cost
$90K–$170K
provisional estimate
This phase represents a post-launch expansion layer designed to reduce entry friction by allowing users to enter Bitcoin Storm directly from external wallets and blockchains — without manually using exchanges or bridges.
Core Objective: Enable users to convert assets they already hold into ICP and enter the Bitcoin Storm system without manually using exchanges or bridges.
Connect wallet → Select tokens → Automatic swap routing → ICP deposited into Storm → Participation activated
Connect wallet → Select tokens → Automatic swap routing → ICP deposited into Storm → Participation activated
11.1
External Wallet Integration
Est. 220–320 hours.
PHASE 11.1External Wallet Integration
Integrations include: Phantom (Solana), MetaMask (Ethereum / EVM), WalletConnect, Trust Wallet, Coinbase Wallet.
Work Includes
- wallet connection APIs
- address verification
- balance discovery
- transaction request routing
Deliverables
- multi-wallet connection interface
- wallet authentication module
11.2
Token Discovery Engine
Est. 120–180 hours.
PHASE 11.2Token Discovery Engine
Work Includes
- scanning connected wallets for supported assets
- token metadata retrieval
- supported token whitelist logic
- asset display in the user interface
Deliverables
- token discovery module
- asset selection interface
11.3
Swap Aggregator Integration
Est. 140–220 hours · Using established aggregators.
PHASE 11.3Swap Aggregator Integration
Integrates with established swap aggregators rather than building a custom DEX routing engine — significantly reducing engineering complexity and cost while maintaining full swap functionality.
Initial Integrations: Solana: Jupiter Aggregator · Ethereum/EVM: 1inch Aggregator
These internally route trades across Raydium, Uniswap, Aerodrome, PancakeSwap.
These internally route trades across Raydium, Uniswap, Aerodrome, PancakeSwap.
Work Includes
- aggregator API integration
- swap quote retrieval
- transaction routing through connected wallets
- swap execution monitoring
- ICP deposit confirmation logic
Deliverables
- swap aggregator integration module
- quote retrieval interface
- transaction execution handler
- swap monitoring system
11.4
Cross-Chain Conversion Routing
Est. 160–260 hours.
PHASE 11.4Cross-Chain Conversion Routing
Work Includes
- chain conversion routing logic
- asset bridging coordination (when required)
- ICP acquisition process
- automated deposit verification
Deliverables
- cross-chain conversion module
- ICP deposit routing system
11.5
Security & Transaction Verification
Est. 120–180 hours · Non-custodial security architecture.
PHASE 11.5Security & Transaction Verification
Security Architecture: The protocol never takes custody of user private keys. Users approve transactions directly in their wallets. All signing occurs in the user's wallet, never within the Bitcoin Storm system.
Work Includes
- wallet transaction validation
- signature verification
- transaction status monitoring
- fraud prevention checks
Deliverables
- wallet security module
- transaction verification layer
11.6
User Interface Integration
Est. 120–180 hours.
PHASE 11.6User Interface Integration
Work Includes
- wallet connection interface
- token selection screen
- swap confirmation interface
- progress tracking for conversions
Deliverables
- cross-chain entry interface
- wallet interaction UI
11.GOV
Phase 11 Oversight & Payment Milestones
Recommended milestone structure for Phase 2 engagement.
Oversight Controls
- weekly engineering progress reports
- repository transparency and commit tracking
- independent code review permitted
- AI-assisted code auditing permitted
- external security review permitted
Payment Milestones
| Milestone | % |
|---|---|
| Architecture completion | 20% |
| Wallet integration completion | 25% |
| DEX routing engine completion | 25% |
| Cross-chain conversion completion | 20% |
| Final integration testing | 10% |
∑2
Updated Project Engineering Totals
Full program budget — both phases combined.
| Phase | Hours | Cost |
|---|---|---|
| Phase 1 — Core Protocol (Phases 1–10) | 2,250–3,000 | $240K–$320K |
| Phase 2 — Cross-Chain Expansion (Phase 11) | 900–1,400 | $90K–$170K |
| Security Audit (recommended) | — | $40K–$80K |
| ICP Cycles / Operational | — | $15K–$30K |
Recommended Total Project Budget
Total engineering hours: 3,150–4,400
Separating the build into two phases aligns with the protocol-first development model commonly used in blockchain projects. Phase 1 delivers the deterministic Bitcoin Storm protocol. Phase 2 expands accessibility and dramatically increases the addressable user base by allowing users to enter the system directly from the wallets and chains they already use.