Fully onchain · Arc · ERC‑721
A wax seal, restored onchain. You sign once, and the signature is the only thing the image is made of.
r—
s—
v—
wax—
§ 01
English has two words descended from sigillum, and most people never notice they are related. The name works on three levels.
sigillum
via Old French seel
seal
the legal road
borrowed direct from Latin
sigil
the esoteric road
Signum meant a sign or a mark. Its diminutive sigillum meant a little sign — specifically a small figure, and by extension the engraved stamp that pressed it into wax. That word entered English twice: through Old French seel it became seal; through direct Latin borrowing it became sigil. Same word, two roads, two meanings.
In magical practice a sigil condenses a statement of intent into a glyph you can no longer read. The engine performs the same operation on a signature: all of the information is present, none of it recoverable.
Every codebase abbreviates an ECDSA signature the same way. The abbreviation machines use, extended back into the word the Romans used.
SIG+IL
One went legal, one went esoteric. This project sits exactly where they split.
Before digital signatures, a wax seal pressed with a privately-held matrix was how a charter, a treaty, or a letter of credit was authenticated. The matrix was unique, kept in your possession, and losing it was catastrophic — a private key in every functional respect.
SIGIL restores that instrument onchain. A collector mints an unsealed token: a pool of undyed wax, identical to every other. To seal it they sign a message with their wallet. The contract runs ecrecover, confirms the signature belongs to the caller, and permanently stores the signature’s three components. Those three numbers are the only input to the artwork. Sealing is one-way.
§ 02
Most generative collections seed from a block hash, a mint index, or a pre-committed list. All three mean the collector receives a number rather than produces one. A signature is different.
01
It requires the private key. There is no shortcut.
02
The space is astronomically large.
03
ECDSA uses a nonce, so even you cannot know your mark before you make it.
04
Ecrecover returns the address that produced it. Provenance is a computation anyone can repeat, not a database claim.
§ 03
Four steps, all integer arithmetic. The same signature produces the same mark on any machine, forever.
sign
The contract calls ecrecover and rejects anything that does not resolve to your own address.
r
Read two bits at a time. Each pair is a heading.
| 00 | north |
|---|---|
| 01 | east |
| 10 | south |
| 11 | west |
s
Read in step with the heading. Each pair plus one gives the run length, one to four cells.
v
The completed path is overlaid with its own rotation. This is what turns a random walk into a balanced mark.
§ 04
This page generates a throwaway private key, signs one fixed message with it, and presses the result. It is a demonstration of the mechanic, not a mint.
No wallet Nothing is connected and nothing leaves your browser. The key below is made here, used once, and forgotten when you close the tab.
Take that key, sign that exact message, and you get this exact image back. Unforgeability is not a claim on this page — it is something you can go and check.
§ 05
Every blank is identical. The wax is undyed because the palette derives from the signature, and there is not yet a signature.
one‑way
Sealing is irreversible. The contract will not accept a second signature for a token, and there is no function that removes the first. What you press is what you keep.
§ 06
No IPFS. No server. No metadata folder that can rot. If the chain is alive, the art renders.
slot 0
slot 1
/// Two slots. Written once, never changed.
struct Seal {
bytes32 r;
uint256 sv; // s in the low 255 bits, v's parity in the top
}
/// Press a signature into an unsealed token. One way, and only yours.
function seal(uint256 id, bytes32 r, bytes32 s, uint8 v) external {
if (_seal[id].r != 0) revert AlreadySealed();
if (ownerOf(id) != msg.sender) revert NotYourToken();
if (ecrecover(_digest(id), v, r, s) != msg.sender) revert NotYourSignature();
if (uint256(s) > HALF_N) revert HighS();
_seal[id] = Seal(r, uint256(s) | (uint256(v - 27) << 255));
emit Sealed(id, msg.sender);
}
/// The artwork is computed, not stored. A view call, so reading is free.
function tokenURI(uint256 id) public view override returns (string memory) {
Seal memory k = _seal[id];
bytes memory art = k.r == 0
? _undyed() // a pool of undyed wax
: _press(k.r, bytes32(k.sv & S_MASK), uint8(k.sv >> 255) + 27);
return string.concat("data:application/json;base64,", Base64.encode(_json(id, art)));
}§ 07
There is no trait list and no rarity table, because there was never a roll. After a walk completes you can measure it. Every one of these is derived after the fact.
Sorting the collection by coverage means sorting by a property of the secp256k1 curve. Nobody chose this shape.
| Coverage | Seals |
|---|
§ 08
Arc is Circle’s open L1 for the world’s financial markets, with a founding validator set of institutions including BlackRock, DTCC, ICE, Mastercard and Visa. Gas is denominated in USDC.
Gas on Arc is denominated in USDC, so sealing is priced the way it always was. Sealing fees were a chancery line item for six hundred years.
Anyone may press a mark; institutions attest to it. That is exactly how seals worked.
SIGIL is a cultural object on a settlement layer, not another PFP on another NFT chain.
§ 09
Humans cannot compare hex strings. SIGIL is a renderer that turns a signature into something the eye can hold. The collection is the first thing built with it, not the only thing that could be.
This is why OpenSSH ships VisualHostKey. A person who would never notice one wrong character in a sixty-four character fingerprint will notice a different picture immediately. The eye is very good at shapes and very bad at hexadecimal.
The same renderer that presses a seal into a token can be called by any contract, for any signature. What follows is not a roadmap. It is what the primitive makes possible.
01
An N-of-M transaction produces several signatures. Composite them into a single mark, each signer contributing a quadrant. You can see at a glance that three of four signed, and which three. Medieval heraldry solved this with quartering, dividing a shield to show the houses that stood behind a claim. The problem has not changed.
settlement-01
—
treasury-02
—
custody-03
—
02
Arc supports agentic economic activity: autonomous agents holding keys and signing on behalf of institutions. “Which agent did this” becomes a real question, and an address is a poor answer. An operator watching a fleet can recognise one by sight before reading a single character.
03
Before a treasury desk approves a transfer, show the seal of the counterparty key. Two addresses that differ only in the middle are visually identical in hex and trivially confused. Their seals are not. Address poisoning depends on hex being unreadable; this makes it readable.
04
A key authorised by another key renders as a seal nested inside a seal. Delegation becomes visible. You can see how deep an authority runs without reading a permissions table — which is precisely what a counterseal did on a medieval charter, the lesser seal set within the greater to show authority passed down.
None of this requires a token, a treasury, or a promise. It requires a deterministic renderer that anyone can call and everyone can verify.
That part already exists.
§ 10
Three of these are not decided yet. When they are, they will be stated here and nowhere else first.
| Supply | TBA |
|---|---|
| Price | TBA |
| Date | TBA |
| Chain | Arc |
| Mint | OpenSea |
| Standard | ERC‑721 |
| Canvas | 32 × 32 |
| Traits | derived |