Documentation · Permanence, made verifiable

The art cannot die.

Every artwork on Perpetual is provably permanent, and that permanence does not depend on Perpetual. A mandatory on-chain STATE shard (SSTORE2) anchors each token to Ethereum. Anyone can reproduce the verification, and the entire index can be rebuilt from public data alone. This page explains, precisely, how.

0% permanence integrity0% onchain-proof coverage

We claim exactly one thing, and we claim it precisely: the artwork survives. The orderbook and index are run conventionally, centralized for speed, and their failure can never touch your art or your ownership. We do not claim a decentralization we have not built.

The problem

Most NFT art is one missed invoice from gone.

The token lives on Ethereum forever. The file it points to usually does not. When a pin lapses or a server goes dark, the chain still records your ownership of something that no longer resolves to anything.

Pin lapses

An IPFS pin stops being paid for.

The CID is valid; no node serves it. The image is gone.

Server offline

The hosting domain in the tokenURI expires.

The metadata 404s. The token points to nothing.

Operator vanishes

The marketplace that pinned the media shuts down.

Everything they hosted disappears with them.

Most NFTs are a pointer to a file held somewhere fragile. The token is permanent; the art it references is not. When the pin lapses or the server dies, the chain still says you own it, but there is nothing left to see.

Perpetual inverts the dependency. The artwork itself is written into Ethereum as a mandatory onchain proof shard. The other backends add resolution and redundancy. None of them is what keeps the art alive, so none of them can take it down.

tokenURI → fragile host  ·  Perpetual → onchain content

The storage model

Five parallel shards. One consensus-guaranteed backstop.

Each token carries five parallel, independently-verifiable shards across independent storage backends. Four add resolution and redundancy. Shard 0 — the STATE shard, stored on-chain via SSTORE2 — is the consensus-guaranteed permanence backstop, and the only one permanence actually requires.

Shard 4 Irys

datachain

Shard 3 Arweave

permaweb

Shard 2 IPFS

content-addressed

Shard 1 LOG

LogLedger

Shard 0 STATE

Consensus-guaranteed backstop

Survives as long as Ethereum

Five parallel shards, layered in depth. One consensus-guaranteed STATE backstop.

Shard 0

STATESSTORE2

Permanence guarantor

Shard 1

LOGLogLedger

Shard 2

IPFScontent-addressed

Shard 3

Arweavepermaweb

Shard 4

Irysdatachain

Five parallel shards · one consensus-guaranteed STATE backstop

Shard 0STATEMandatory

Low-res canonical image written on-chain as contract bytecode via SSTORE2. Content hash computed on-chain. Consensus-guaranteed — lives in contract state, cannot be pruned.

shard0Configured(tokenId) · mandatory · consensus-guaranteed

Shard 1LOGRedundant

Full-resolution primary copy stored in event logs via a standalone LogLedger contract (~8 gas/byte). Merkle root + size live in contract state; root-verifiable by anyone.

Merkle-verified · retention-monitored (EIP-4444) · not consensus-guaranteed

Shard 2IPFSRedundant

Redundant off-chain copy, pinned via Pinata, addressed by the hash of its own content.

CID = hash(content) · auto-pinned · backstopped by STATE

Shard 3ArweaveRedundant

Pay-once permanent storage on an independent network.

confirmed permanent · endowment-funded · independent of Perpetual

Shard 4IrysRedundant

A second permanent off-chain network, for redundant independence.

confirmed · separate operator · separate failure domain

Shard 0 is the guaranteeWhy this holds

Because the STATE shard (SSTORE2) is consensus-guaranteed and lives in contract state, it is the permanence backstop on its own. The LOG shard and off-chain copies (IPFS, Arweave, Irys) are performance and redundancy optimizations, not permanence obligations. If Perpetual stops paying for pinning, permanence is unaffected. This is the point most architectures miss: permanence is decoupled from operator solvency. The art does not depend on us staying in business.

Interactive & generative art

For code-based art, storing the file was never the hard part.

An interactive piece that loads a library from a CDN or a font from a third party stores fine and renders blank the day that link rots. Permanence for HTML art is about eliminating every off-chain dependency. Perpetual does this in three tiers.

Tier 1 · Default

Inlined & self-contained

Drop a .zip of your piece — index.html plus its scripts, styles, fonts, and images. At upload we inline every local asset into one dependency-free HTML file, so it renders off any single shard with zero external calls. Nothing to rot.

Tier 2 · Large works

Arweave path manifest

For pieces too large to inline, the whole folder is stored as an Arweave (and Irys) path manifest, so relative links resolve permanently on the gateway — pay-once, endowment-backed permanence for multi-file works, with the structure intact.

Tier 3 · On-chain libraries

Dependencies on-chain

Reference a library by name — <script data-onchain="three.js"> — and it is read from the ScriptStore contract (SSTORE2, content-hash sealed) and inlined at render. The artwork renders even if every gateway and CDN on earth disappears. Nothing off-chain remains.

Whichever tier a work uses, its bytes are hashed and the hash is written on-chain at mint — so any copy, from any source, is verifiable against the record.

The honest limit

Inlining every dependency removes the rot we can remove. What no contract can promise is the runtime: a browser, a JavaScript engine, WebGL and GPU APIs are not themselves permanent. The bytes of an interactive piece are preserved and self-contained; whether they still render faithfully in fifty years depends on that runtime surviving. A still image, by contrast, decodes with universal codecs and needs no runtime at all.

So we grade permanence honestly, not as a single badge. Every token page shows a durability profile across three axes — storage (is it stored on-chain and redundantly?), rendering (self-contained image, codec-dependent video, or runtime-dependent code?), and chain (on-chain durability inherits the chain's data-availability class) — and names the single limiting factor plainly. Permanence is a spectrum; we tell you where each work sits on it.

The verification service

Do not trust us. Reproduce it.

A read-only service continuously resolves every shard, hashes the content it gets back, and compares that hash against the record written onchain at mint. It reads only public data, so anyone can run the exact same checks and arrive at the exact same result. Verifiability, not our word.

01

Resolve

Fetch the bytes from every shard.

GET onchain · ipfs · arweave · irys

02

Hash

Hash the content that came back.

keccak256(content) → 0x…

03

Compare

Check it against the onchain record.

getMintData(tokenId).metadataHash

04

Status

Report a verifiable result.

match → permanence integrity 100%

read-only · independently reproducible · no proprietary inputs

The architectural invariant
“Perpetual can disappear entirely and every NFT remains fully intact: owned by the correct wallet, resolving to its artwork via the onchain proof shard, with complete provenance. A third party can re-index the contracts and stand up a replacement marketplace with zero cooperation from us.”

This is not a feature of Perpetual. It is the property Perpetual exists to preserve. Every decision on this page is tested against the sentence above. If a choice could break it, the choice does not ship.

Ownership

stays onchain, always correct

Artwork

resolves via Shard 0, forever

Provenance

complete, public, rebuildable

The published indexer spec

The index is public infrastructure, not a moat.

The indexer reads only public onchain and storage data, and its schema is published in full. Anyone can run their own against the same sources. That openness is precisely what makes the invariant enforceable rather than merely promised.

schema.v1 · published
Public data onlyRe-indexable
# perpetual-indexer / schema.v1
# Reads ONLY public onchain + public storage data.
# No proprietary inputs. Anyone may run this to reconstruct the index.

source contracts {
  forever_library  native   # marketplace-deployed instances
  forever_library  sovereign # artist-owned instances (federated)
  settlement       seaport  # order fills, cancellations
}

record mint {
  contract       address
  token_id       uint256
  creator        address
  block_number   uint64
  timestamp      uint64       # block time
  title          string
  media_type     enum
  royalty_bps    uint16
  metadata_hash  bytes32      # from getMintData(tokenId)
}

record shard_status {
  token_id       uint256
  index          uint8        # 0 = STATE (SSTORE2, mandatory) · 1 = LOG (LogLedger)
  backend        enum         # onchain | log | ipfs | arweave | irys | cdn
  resolves       bool
  hash_matches   bool         # hash(content) == mint.metadata_hash
  locked         bool         # isLocked(tokenId)
  last_checked   timestamp
}

record settlement {
  order_hash     bytes32
  token_id       uint256
  from           address
  to             address
  price_wei      uint256
  royalty_paid   uint256      # enforced at settlement (ERC-2981)
  block_number   uint64
}

derive {
  ownership         <- transfers ∪ settlements   # current holder
  provenance        <- mint ∪ transfers ∪ sales  # full history
  permanence_status <- shard_status              # per-token integrity
}

Because every input is public, a third party can stand up an identical index with zero cooperation from Perpetual. An open schema is what turns the invariant from a promise into something you can verify for yourself.

Enforced royalties

Enforced at settlement. Not optional.

Royalties are checked at the protocol level, via ERC-2981, against the token's onchain configuration. A sale that does not honor the artist's royalty is rejected by the settlement contract itself. There is no marketplace toggle that turns this off.

Protocol-level guarantee

Not a UI suggestion, not an honor system. The contract enforces it on every fill.

LookuproyaltyInfo()
StandardERC-2981

dishonored royalty → settlement rejected

0%

Permanence integrity

0%

Onchain-proof coverage

0

Verified shards

0

Works archived

The art survives, even if Perpetual does not.

Browse work engineered to outlast its marketplace, or mint your own onto a record that cannot be revoked.

Explore the collectionMint permanent art