Arweave
KLEAR3 ResearchPublished 2026-08-20Updated
ArweaveARArweave, a storage network that charges once for a file instead of billing for it every month, has been publishing code since August 2017 under a licence GitHub recognises. Its endowment holds 349 590 AR, its default branch has gone quiet, and the software its own gateway reports running is not in the public repository.
How Arweave works
One payment, at one moment. Part of it pays the miner who takes your file, the rest joins a reserve that pays whoever still holds it years from now.
- 1You ask the network what a given number of bytes costs, and pay that once.
- 2Part of the fee pays the miner; the rest goes into the endowment.
- 3Anyone reads the file back through a public gateway, presenting nothing.
What does Arweave actually do?
Arweave sells storage the way you buy a plot of land, not the way you rent a locker by the month. You ask the network what a given number of bytes will cost, you pay that amount once, and the nodes then hold the file. No monthly line, and no renewal date anywhere in the mechanism.
The price is not a published tariff, it is an answer. You name a size, the network names a figure, and it names it in the smallest unit it counts with. A gibibyte came back at about 11.96 AR on the day we asked. Ask tomorrow and you will get another number, because the quote tracks the network difficulty and the recent history of what people have paid.
Here is where that money goes, and it is the part almost nobody explains. Part of your fee goes straight to the miner who includes your transaction, which is what makes anyone bother taking your data at all. The rest goes into an endowment, a reserve the protocol pays out from, slowly, to whoever proves they are still storing your file years later. Uploading therefore takes tokens out of circulation rather than handing them to somebody.
The arithmetic behind the promise is published and it is unusual enough to state plainly. You are charged for 200 years of replicated storage at today's prices. The protocol then only needs storage costs to fall by 0.5% a year for the reserve to last indefinitely.
Over the last fifty years they have fallen by roughly 38.5% a year. That gap is the whole bet: it is wide, it is documented, and it is still a bet on the future rather than a measurement.
Source Arweave Docs https://docs.arweave.org/developers/development/overview.md, read 2026-08-21
Is the code actually open?
Yes, and unusually so. GitHub identifies a real copyleft licence on the published code, which means anyone may reuse it on the same terms. The repository also carries a folder of papers, one of them a security review commissioned by the project. That review took 4 days, and it says so itself.
The licence field returns GPL-2.0, a real copyleft licence. Directories that print a green badge here happen to be right, which is not the same as having checked. On the other profile we published, the same field returned nothing at all, and half the directories printed a badge anyway.
Source GitHub https://api.github.com/repos/ArweaveTeam/arweave, read 2026-08-20 · GitHub https://api.github.com/repos/ArweaveTeam/arweave/releases?per_page=100, read 2026-08-20
We opened it, so here is what it found rather than how many logos it carries: 0 critical, 0 high, 1 medium and 1 low. Both findings carry the status New in the report's own table, which means they were open at the moment it was delivered. The medium one warns that a checksum computed differently across processor architectures could make data temporarily unreadable.
The report also describes its own limits on its first page: one algorithm, in one pull request, at one commit, and the cryptographic function underneath it written out of scope in so many words. That is a normal, useful review of a specific upgrade. It says nothing about the rest of a codebase that has been running since 2017, and nobody should read it as though it did.
Source GitHub https://api.github.com/repos/ArweaveTeam/arweave/contents/papers, read 2026-08-20 · NCC Group, read 2026-08-20 · NCC Group raw.githubusercontent.com/.../papers/NCC_Group_ForwardResearch_E020578_Report_2024-12-06_v1.0.pdf, read 2026-08-21
Is anyone still working on it?
Not where we can see it. The default branch has taken nothing in 90 days, and the branch called develop has taken nothing either. The repository still reports a push in late June, onto a branch we did not identify. Issues were being answered 2 days before this page.
Two readings from the same API, and they do not line up. That is not a bug in either of them: the field that reports the last push counts any branch, while the endpoint that lists commits answers about one branch at a time. We checked the obvious second branch and found it empty too, then stopped. The claim stays marked as a disagreement, because we would rather show the seam than smooth it over.
What the public record does show is a project that answers. 6 public events in the window we could read, half of them replies on issues, the most recent 2 days before this page went up. Quiet and abandoned look identical from a distance, and they are not the same thing. Our methodology sets out what we will and will not conclude from a branch that has stopped moving.
Source GitHub https://api.github.com/repos/ArweaveTeam/arweave/commits?sha=master&since=2026-05-22T00:00:00Z, read 2026-08-20 · GitHub https://api.github.com/repos/ArweaveTeam/arweave ; GET https://api.github.com/repos/ArweaveTeam/arweave/commits?sha=develop&since=2026-05-22T00:00:00Z, read 2026-08-20 · GitHub https://api.github.com/repos/ArweaveTeam/arweave/events?per_page=100, read 2026-08-20
- Core repository made public
- The warrant canary last touched
- The security review published in the repository
- Most recent commit on the default branch
- Most recent numbered release
- This page, checked and published
Where does it actually run?
Arweave runs on its own network rather than on top of somebody else’s, and it currently holds a weave of several hundred terabytes. We asked 2 independent gateways the same question within the same minute and they answered with different software versions. One names the commit it runs, and that commit is not in the public repository.
A storage protocol has no application to photograph. Its interface is an HTTP response, so here is one, copied out of the terminal rather than redrawn.
GET https://arweave.net/info
{"version":5,"release":94,"queue_length":0,"peers":210,
"node_state_latency":1,"network":"arweave.N.1",
"height":1983897,
"git_hash":"9ec542ff1abbe30f326c0a9d2483cbc1623967e0",
"blocks":1983898}Look at the second to last line. The node tells you which build it is running, which is more openness than most software offers. We put that hash to the repository and got back No commit found for SHA.
There are dull explanations, an unpushed branch, a rewritten history, another repository entirely, and we cannot choose between them from outside. What we can say is that the published code and the running code cannot be tied together by anyone who tries, and no directory we know of tries.
The same block that carries the endowment carries the size of what the network keeps: 354.6 TiB of replicated data. That is the figure the storage price is quoted against, and it only goes up.
Source Arweave https://arweave.net/info, read 2026-08-20 · Arweave https://arweave.net/info ; GET https://permagate.io/info, read 2026-08-20 · Arweave + GitHub https://arweave.net/info ; GET https://api.github.com/repos/ArweaveTeam/arweave/commits/9ec542ff1abbe30f326c0a9d2483cbc1623967e0, read 2026-08-20 · Arweave https://arweave.net/block/current, read 2026-08-21
ArweaveThe mark above is the project’s own logotype, served byte for byte from the original file in its brand kit: not cropped, not recoloured, not traced. Its brand terms allow redistribution and forbid derivatives, so the two vector files the site serves today are unusable here, being dimensioned construction sheets carrying grey guide strokes. The archives that page links to were all returning errors on 2026-08-21, so the original came from an archived capture of the same page.
What the token actually does
AR buys storage, and that is nearly all it does. There is no vote attached to it and no staking contract to lock it into. The supply is close to its ceiling, the endowment holds a measurable slice of it, and what remains to be issued is now a fraction of a percent.
The ceiling is written in the protocol's own source, not taken from a price site. The genesis block held 55 000 000 tokens, and mining rewards follow a curve that halves every year and whose total comes to a fifth of that figure, so 11 000 000 more. Ceiling: 66 000 000.
Source ArweaveTeam/arweave raw.githubusercontent.com/.../apps/arweave/include/ar.hrl ; .../src/ar_inflation.erl, read 2026-08-21
Two live readings say how far along that curve the network is. Wallets hold 65 586 781 AR, and the endowment holds 349 590 more. Together that is 65 936 371 against a ceiling of 66 000 000, so roughly 63 629 AR remain to be issued, ever.
What that means fits in one line: emission is essentially finished, so it is not a future risk on this profile.
Source Arweave https://arweave.net/total_supply, read 2026-08-21 · Arweave https://arweave.net/block/current, read 2026-08-21
One caution on that arithmetic. The supply endpoint sums the balances of every account in the current block, so it moves between readings: we read it twice a few minutes apart and it had shifted by about 23 AR. At this precision that changes nothing, and the direction is what the protocol documentation describes, uploads moving tokens out of wallets and into the reserve.
Governance is the shortest section on this page, because there is no governance. Protocol changes are 16 block heights written as constants in the source, and a change takes effect only on the nodes that run the release containing it. No vote, no token weight, no delay to observe. Miners decide by upgrading or by refusing to, which is the oldest governance mechanism there is and the least legible from outside.
Source ArweaveTeam/arweave raw.githubusercontent.com/.../apps/arweave/src/ar_fork.erl, read 2026-08-21
- What AR is used fordirectly verified
- The unit the network counts indirectly verified
- What storage costs, quoted livedirectly verified
- Total supply and its ceilingdirectly verified
- Emissions and what remainsdirectly verified
- Distributionthird-party supported
- Governance rightsdirectly verified
KLEAR3 rating
- Open code4
public repository · GPL-2.0 licence · 81 published releases
What holds it back no activity in 90 days
- Audits3
2 firms on the core · 2 audited scopes · report opened: 0 critical, 0 high, 1 medium · no critical or high finding
What holds it back audit stops at 2024-12-06: the code has moved since
- Business model5
business model published by the protocol · paid by celui qui téléverse un fichier · collected by les mineurs qui conservent les données · le paiement entre dans une dotation censée financer deux siècles de stockage
- Governance2
decided by block heights hard-coded in the source, with no vote · 16 protocol upgrades on record
- Token alignment3
total supply read on-chain · circulating share known · emission schedule published
What holds it back fate of the initial allocations not established
- Maturity4
9 years of public code · 1 network verified by us
We rate the protocol: how it is built, how much of it can be checked, how its token lines up. Never an investment. A high score is not advice to buy, and a low one is not advice to sell.
What we could not establish
Who holds AR, and whether the endowment lasts. The account tree is served, in chunks, but it is binary and sorted by address rather than by balance, so no ranking of the largest holders can be built without walking all of it. The second gap is not a measurement at all.
We can now tell you exactly how large the endowment is, which nobody else seems to print. We cannot tell you whether it is large enough. That depends on storage costs continuing to fall for two centuries, and no reading of any endpoint settles a forecast.
The warrant canary belongs in the same column: 4 statements, each dated 2024-03-22, and the file untouched since. We report the date and stop there, because reading intent into a canary that has not moved is exactly the guess this site exists to avoid.
Source Arweave https://arweave.net/wallet_list/96HpheWfJzBI6aILauteTVWziCsxZxpPX5okmEqxwCYbszggZOBQBL9VDi-H4q2e, read 2026-08-21 · GitHub https://api.github.com/repos/ArweaveTeam/arweave/commits?path=CANARY.md, read 2026-08-20
Frequently asked questions
Does “permanent” mean my file will still be there in fifty years?
The mechanism has no end date, and the promise rests on an assumption you should see. What we established: you pay once, nothing bills you again, and there is no expiry field or renewal anywhere in it. Part of that payment goes to the miner who takes your file, and the rest joins an endowment that slowly pays whoever still proves they hold it.
We measured that reserve rather than taking the project's word for it: it holds about 349 590 AR today. What nobody can measure is whether that is enough. The protocol charges you 200 years of storage at today's price and needs costs to fall 0.5% a year to last indefinitely; over fifty years they fell roughly 38.5% a year. Wide margin, published assumption, and still a forecast about the next two centuries rather than a measurement of them.
Why does this page say the running code cannot be tied to the published code?
Because we tried and it did not match. The reference gateway publishes the commit hash of the build it runs, which is already more than most software says out loud. We put that hash to the repository through its own interface, and the answer came back as no commit found for that identifier.
Several ordinary explanations fit. The commit may live on a branch nobody pushed, the history may have been rewritten since, the gateway operator may run a fork or another project entirely, and none of that would be remarkable. What we cannot do is settle it from outside, and neither can you. The claim therefore says the sources disagree, without accusing anyone.
The point is narrower than it looks and worth keeping: a reader who wants to check that the running code is the published code cannot do it today.
Who decides what changes in Arweave?
Whoever runs the software, and that is the whole answer. There is no governance token, no proposal, no vote, and no treasury to allocate. Protocol upgrades appear in the code as block heights written into constants, and a change only becomes real on the nodes that install the version carrying it.
We count 16 of them so far. A miner who declines to upgrade goes on validating the old rules, and if enough miners decline, the change simply does not happen.
That is more honest than it sounds and harder to observe than a vote: there is no proposal page to read and no result to show, so you learn what was decided by watching which version the network converged on. A decision here cannot be bought, it has to be argued and then shipped.
peak 354.6 TiB (2026-08-21) · today 354.6 TiB · data stored by the network · Arweave GET https://arweave.net/block/height/{height}, read 2026-08-21
Where to read on, at the source — every address answered 200 on 2026-08-21.
Related: our profile of Pendle shows what the same method finds on a protocol that keeps almost nothing on its own network, and our Bitcoin profile shows the other way of running a network with no company issuing it.
Ask an assistant to summarise it and check what it claims.