Anchor

Digital preservation, the part nobody promised

• Content addressing proves what a file is, not that it still exists
• A CID guarantees integrity and authenticity, not availability
• Persistence is a separate problem, someone has to keep storing the bytes

How an NFT actually stores its art

• The token on chain is small, an ID plus a pointer
• The artwork lives off chain, on IPFS or Arweave
• Metadata references the media, often by URI string
• The chain is permanent. The thing it points at frequently is not.

Two storage models, two failure modes

• IPFS: content addressed, but pin or perish. Persistence requires someone to keep pinning. Platforms pin on your behalf, until they stop.
• Arweave: pay once, an endowment funds miners to store it long term. Permanence is the protocol’s job.
• Same artwork, completely different durability guarantees

The problem Anchor solves

• Collectors do not control where their art is actually stored
• The common case, a single platform pinning service holds the only copies
• If that service disappears, the bytes can vanish while the token lives
• No independent, local, verifiable copy you own

Anchor in one line

• A plug-and-play appliance that keeps your own verified local copy of your collection, and helps preserve others’
• No private keys, no seed phrases, read-only public wallet addresses

System overview

• ARM appliance, NVMe storage, Fedora CoreOS, Podman managed containers
• Stock building blocks, Kubo for IPFS, an AR.IO gateway for Arweave, lightweight Tezos and ETH context
• A Go control daemon ties it together and serves the local UI
• Two jobs: back up your wallets, and contribute to community preservation

The core pipeline

1. Read a wallet’s NFTs from the chain
2. Recursively resolve every referenced IPFS and Arweave object
3. Pin the IPFS CIDs locally, fetch the Arweave objects locally
4. Serve and display everything from the local copy

Design choice: do not cross-store IPFS and Arweave

• Replicate IPFS content, because IPFS has no inherent permanence
• Trust Arweave’s endowment for Arweave content, it is already permanent
• The gateway gives a local retrieval path, and optionally re-seeds

Design choice: honest Arweave re-seeding

• A local copy can be pushed back to Arweave to re-replicate lost data
• Key-less and free, chunks validate against the on-chain data root
• Works while Arweave’s chain survives, not if it fully collapses
• Bundled NFTs need the parent bundle retained, not just the file

The community preservation layer

• Permissionless preservation of public collections
• Any node nominates any public wallet over a gossip network
• A handful of nodes each pin it, best effort, always on
• Adds redundancy for art whose only host is fragile

Design choice: HRW selection

• Rendezvous hashing over the known Anchor roster for maintaining R copies

H = SHA256("anchor-v1" + wallet_address)

# rank nodes, top R are responsible
score = hash(PeerID || H)   

• Stable assignment, minimal reshuffle when nodes come and go

Design choice: replication is a floor, not a constant

• “Exactly N copies” is fiction under churn
• Track live replicas, refill when the count drops
• Backers, not the original owner, re-announce a wallet

Design choice: what we deliberately left out

• No hardware identity or certificate authority, it reintroduces a central issuer
• No wallet signing, too much friction, so ownership is unprovable, so we made the model permissionless instead
• No Sybil hardening in the beta, the attack payoff is near zero

Design choice: your wallets are not linked to your IP

• Read-only public addresses, no keys, no seed phrases, ever
• Wallets are announced from a throwaway, ephemeral network identity
• That traffic is relayed, peers see a relay, not your home connection
• The management UI is local only, never exposed to the internet

Design choice: secure by default

• Fedora CoreOS, an immutable image-based OS, signed atomic updates
• Failed update, automatic rollback to the last good image
• Containers auto-update, Podman with systemd, zero-touch maintenance
• No secrets to steal, the device only ever holds public data

Threat model, stated plainly

• Protects against: a pinning service or platform disappearing, your own device failing
• Does not protect against: total Arweave collapse, a determined Sybil attacker on an open network
• The beta is a functional test of the protocol, not a durability proof

The beta

• Virtual machines first, around 25 participants, hardware later
• Permissionless community layer enabled by default
• Rendezvous hashing with a small replica target, on purpose, to exercise the real selection path before scale
• Open source

Roadmap

• Tezos support through an indexer adapter
• Hardware rollout of the appliance
• Local display and media-server integration, art served from your own node
• Ecosystem integration, pre-populating wallets from partner platforms

Takeaways

• Permanence on chain does not mean the art persists
• Anchor gives you an independent, verifiable, local copy, no keys
• A permissionless layer preserves at-risk public work
• Every design choice is a stated trade, not a hidden assumption