← MOONDAO Learn

Crypto Encyclopedia

The ideas behind crypto and the arcade, each readable by anyone, with deeper asides and a widget you can poke at. Look one up, or read straight through.

What money is

beginner

Money isn't the paper or the coin, it's an agreement. Anything works as money if enough people accept it for three jobs: a medium of exchange (pay for things), a store of value (hold it for later), and a unit of account (price things in it).

The form keeps changing as trust moves: barter (trust the goods) β†’ gold (trust a scarce metal) β†’ fiat (trust a government) β†’ crypto (trust open math and a network instead of any single institution).

deeperWhat crypto really changes is who you trust: not a bank's ledger you can't see, but a public one anyone can verify. That's the thread through the next few entries.

Ledgers & the public ledger

beginner

A ledger is just a record of who owns what, updated with each transaction (Alice pays Bob 5, so subtract 5 from Alice and add 5 to Bob). Your bank keeps one; you have to trust it, you can't see or check it.

A blockchain is a public ledger: the same record, but everyone holds a copy and can verify every entry. No trusted bookkeeper, the rules and the math do the bookkeeping. To spend, you prove you own the funds with a key (next entry); to trust the history, you check the chain (the one after).

Keys & addresses

beginner

A crypto wallet is a key pair. The private key is a secret only you hold, it authorizes spending by producing signatures. The public key (and the addressderived from it) is shareable, it's where people send funds and how anyone checks your signatures.

The asymmetry is the point: the private key can sign, and the public key can verify, but you can't work backward from public to private. That's why β€œnot your keys, not your coins”, whoever holds the private key controls the funds. (See Signaturesfor how a signature actually proves a message came from a key.)

Hashing

beginner

A hash function takes any data, a word, a file, a whole game board, and returns a short fixed-size fingerprint. These games use keccak256, which always returns 32 bytes (64 hex characters).

h = keccak256(data)
Same input always gives the same 32-byte output.

Three properties matter:

  • Deterministic: the same input always gives the same hash.
  • One-way: you cannot run it backward to recover the input.
  • Avalanche: change one bit and the whole output changes.
keccak256(input) =
0x3c61050a35421655441c721d163a8e8568cc126d41746bc5371d9c3e36f4ba4d
change one character β†’ rocket at cell 13
0xb92f0de5e6204b300beef827386f056eecc45dd2bd3e57dcb1976d90dc8d9504

Same input, same output, every time (deterministic). Change a single character and the whole result scrambles (the avalanche effect), and there is no way to run it backward. That is what makes a hash a tamper-evident fingerprint.

deeperIt is also collision-resistant: finding two different inputs with the same hash would take roughly 2128 work, which is infeasible. That is precisely what lets a hash stand in for the data as an unforgeable commitment.

Blockchain

beginner

Bundle transactions into a block, hash it, and put that hash inside the next block. Now each block depends on the one before, forming a chain. Change anything in an old block and its hash changes, which breaks the link in the next block, and the next, all the way to the tip. The ledger becomes tamper-evident.

Edit a block and watch the chain break:

block 0 βœ“ linked
prev: 0x0000000000…
hash: 0x47188e4b30…
block 1 βœ“ linked
prev: 0x47188e4b30…
hash: 0x798695754b…
block 2 βœ“ linked
prev: 0x798695754b…
hash: 0xa7d5616b0b…

Each block's hash includes the one before it. Edit any block and every block after it turns red, the chain is tamper-evident, so you can't quietly rewrite history.

deeperThis is why you don't need to trust a bookkeeper: rewriting history isn't hidden, it's instantly visible as a broken chain, and (with the next entry) prohibitively expensive to redo.

Consensus & mining

beginner

With thousands of independent copies of the ledger, how does everyone agree on the same next block, with no boss? That's consensus. Bitcoin's answer is proof-of-work: to add a block you must find a number (a nonce) that makes the block's hash start with a run of zeros. There's no shortcut but guessing, so it costs real computation, but checking a winner is a single hash.

Mine a block, watch the work add up:

difficulty:hash must start with 4 zeros
target
0x0000…
nonce 0 Β· 0 hashes tried
keccak256(block β€– nonce) = 0xe4c29ae4c7a75d52bda2…

Finding the nonce takes lots of guessing (the work). Checking it is one hash. That asymmetry is what makes proof-of-work secure, rewriting a block means re-mining it and everything after.

deeperRewriting an old block means re-mining it and every block after it, faster than the rest of the network extends the honest chain, which is effectively impossible. Newer chains (and Ethereum today) use proof-of-stake: instead of burning electricity, validators put up a stake they lose for cheating.

Decentralization

beginner

Put the public ledger, the chain, and consensus together and you get a system with no single point of control: thousands of nodes each hold the full ledger and enforce the same rules. There's no company to hack, bribe, or shut down, and no one who can freeze your funds or rewrite the record.

That's the trade: you give up a help desk and β€œundo” button, and you gain censorship-resistance and self-custody. It's a spectrum, not a switch, real systems are more or less decentralized depending on who runs the nodes, the clients, and the development.

Smart contracts

beginner

Some chains store more than balances, they store programs. A smart contract is code deployed on-chain that runs exactly as written, enforced by the whole network, with no company able to stop, change, or censor it. Ethereum pioneered this, often called β€œthe world computer.”

deploy(code) β†’ address Β· anyone can call its functions
Every node runs the same code on the same inputs and must reach the same result.

Running code costs gas (a fee paid in the chain's currency), which stops infinite loops and pays the validators. Once deployed, the contract is the rulebook: it holds funds and releases them only when its conditions are met.

deeperBecause it's deterministic and public, anyone can read a contract and predict exactly what it will do, no trust in an operator required. That's the whole basis of the arcade's games: the escrow, burn, and trophy rules live in a contract, not in a server you have to trust.

Tokens

beginner

Not every coin needs its own blockchain. A token is an asset defined by a smart contract on an existing chain, the contract is just a ledger of who owns how much.

balanceOf[address] β†’ amount
Transferring a token is the contract subtracting from one balance and adding to another.
  • Fungible (ERC-20): every unit is identical and interchangeable, like MOON or a stablecoin.
  • Non-fungible (ERC-721 / NFT): each one is unique, like an art piece or a game trophy.
deeperA token has no magic, it's a contract tracking a mapping. MOON is an ERC-20; the arcade's soulbound trophies are ERC-721s that simply refuse to transfer (see Soulbound).

Layer 2 & rollups

beginner

A secure base chain (an L1 like Ethereum) is slow and pricey, every node must process every transaction. A Layer 2 (L2) fixes this: it runs the transactions off the base chain, then posts a compact summary plus a proof back to it, so it inherits the L1's security while being far cheaper.

cost per tx β‰ˆ (L1 batch cost) Γ· (transactions in the batch)
One base-chain posting is shared across a whole batch of transactions.

Drag the batch size to see the per-transaction cost collapse:

batch size:200 txs
200 transactions share one base-chain posting (~$4.00)
$0.02cost per transaction on the L2
on the base chain alone, each tx would cost ~$4.00 β€” that's the 174Γ— saving.

A rollup runs the transactions off the base chain, then posts a compact summary (and a proof) back to it. The work is cheap; the security is inherited from the base chain.

deeperThese batching L2s are called rollups (optimistic ones assume the batch is honest unless challenged; zk ones attach a cryptographic proof). Arbitrum One, where the MOONDAO arcade's contracts live, is exactly this, that's why a whole game costs pennies.

Merkle trees

beginner

Hashing one thing gives one fingerprint. A Merkle tree fingerprints a whole collection into a single root, while still letting you prove any one item cheaply. You hash each item into a leaf, pair the leaves and hash each pair, then repeat until a single root remains.

parent = keccak256( min(a, b) β€– max(a, b) )
Pairs are sorted before hashing, so a verifier doesn't need to know left from right.

Click any cell to see its proof rebuild the root:

root
0x9224a
H(A,B)
0xa26ef
H(C,D)
0x9a8b0

To prove cell A is in the committed tree, you only reveal it plus two sibling hashes (not the whole board):

H(0x9d753, 0xcd334) = 0xa26ef
H(0xa26ef, 0x9a8b0) = 0x9224a
βœ“ equals the committed root 0x9224a

A tree of n cells needs only logβ‚‚(n) sibling hashes per proof (100 cells β†’ 7).

The magic is the proof: to convince someone a single cell is part of the committed root, you reveal only that cell plus a handful of sibling hashes, never the whole board.

deeperA tree of n leaves needs only ⌈logβ‚‚(n)βŒ‰ hashes per proof, so a 100-cell board proves any cell with 7 hashes. Verification just re-hashes up the path and checks it equals the published root.

Commit and reveal

beginner

A commitment lets you lock in a secret now and reveal it later, with two guarantees:

  • Binding: you can't change what you committed. Any change to the data changes the root.
  • Hiding: the commitment (just a hash) reveals nothing about the data.

You publish the root up front. Later, when challenged, you reveal a specific piece plus its Merkle proof. The other side checks the proof against the root you already locked, so you can neither lie about it nor have changed it.

deeperEach cell is salted before hashing. Without a random salt, a ship-or-water cell is one of only two values, which an opponent could simply hash both ways and match. The salt makes each leaf unguessable.

Verifiable randomness

beginner

Lots of games need randomness: a race course, a card shuffle, a loot drop. On a blockchain there is no Math.random(), and the easy sources are unsafe, a block hash or timestamp can be nudged by the validator producing the block, and anything already on-chain can be read and exploited before you act.

The fix is commit-reveal randomness: each participant locks a secret (publishing only its hash), and once everyone is committed they reveal. The shared result is the hash of all the secrets, so no one party can predict it or steer it.

seed = keccak256( secret₁ β€– secretβ‚‚ β€– … )
Hidden until reveal (unpredictable) and locked before you see the others (unsteerable).

Lock two secrets, then reveal to see the course they produce:

You
commitment
0x4bc55eef…
secret
hidden until reveal
Rival
commitment
0x1b7a006d…
secret
hidden until reveal

Both players locked in a secret and published only its hash. Neither can see the other's.

deeperOne subtlety is the last revealer: whoever reveals last sees the result first and could bail if they dislike it. Real systems defend against this with stakes and penalties, or with a VRF (verifiable random function), which emits a random output plus a proof that it was computed honestly from a seed, so it can't be cherry-picked.

Signatures

deeper

A digital signature proves a specific message came from a specific wallet, and nobody can forge it without that wallet's private key. The contract recovers the signer from the signature and checks it matches.

verify( message, signature ) β†’ signer address
EIP-712 signs a typed, human-readable message, e.g. Result(gameId, winner).

This is how a game can be settled with a single cheap transaction: the loser signs a short β€œI concede” message and the winner submits it. No private key ever leaves your wallet.

Soulbound tokens

beginner

Most NFTs can be bought and sold. A soulbound token (the ERC-5192 standard) is one that is permanently non-transferable: once minted to your address, it stays there forever.

That is exactly what you want for a trophy. With no resale market it carries no monetary value, so it is a pure proof of achievement, an on-chain record that you earned it, rather than something bought.