RandomX, Block Weight & the Fee Algorithm

The cryptography hides what is in a transaction; consensus decides which transactions become history and what they cost. This final lesson covers the proof-of-work that keeps mining on ordinary CPUs, and the adaptive block-weight and fee mechanism that gives Monero its famously low, stable fees.

RandomX: PoW Tuned for CPUs

Since Nov 2019 Monero's proof-of-work is RandomX. Instead of hashing fixed data like SHA-256, RandomX generates a random program and runs it in a virtual machine, then hashes the result. The VM uses integer and floating-point instructions, branches, and a large memory buffer — exactly the things general-purpose CPUs are good at.

Its ASIC resistance rests on two pillars that reinforce each other, and it's worth being precise about both:

• Random code execution. To compute the hash you must execute arbitrary random programs, which demands a flexible, general-purpose execution unit — essentially, a CPU. A fixed-function circuit can't specialize for code it can't predict.
• Memory-hardness (the RAM part). Execution randomly accesses a large ~2 GB dataset, so performance is bound by memory latency and bandwidth, not raw compute. Beating a CPU would require integrating gigabytes of equally-fast RAM — the same constraint the CPU already has.

Neither pillar alone would be enough; together they erase the efficiency edge an ASIC would normally have.

• Dataset / cache: RandomX derives a ~2 GB dataset (regenerated each epoch from a key tied to a recent block) for "fast mode" miners, or a ~256 MB cache for "light mode" verifiers. The large, frequently-accessed memory makes the workload memory- and latency-bound.
• ASIC resistance: a fixed-function chip can't meaningfully beat a CPU when the "function" is "execute arbitrary random programs against gigabytes of RAM." The economic incentive to build an ASIC collapses, keeping hashpower decentralized across everyday machines.
• Asymmetry: verifying a share is cheap (light mode), mining is expensive (fast mode) — nodes can validate blocks without the full dataset.

This is why anyone can mine on a laptop, and why mining stays spread out rather than concentrated in industrial farms.

Difficulty and Block Time

Monero targets a 2-minute block time and retargets difficulty every block using a moving window of recent block times (discarding outliers), so hashrate swings are absorbed quickly without the multi-week lurches some chains have.

Dynamic Block Weight: an Elastic Block Size

Monero has no fixed block-size cap. Instead each block has a weight, and the protocol tracks the median block weight over recent windows (a short-term window of 100 blocks and a long-term window of 100,000 blocks). Blocks may exceed the median, but doing so costs the miner via a penalty:

penalty = base_reward · ( (weight / median) − 1 )²     for weight > median

The quadratic penalty means small overflows are cheap and large ones are brutally expensive — the block size can grow to meet real demand but can't be cheaply spammed huge. The long-term median caps how fast the typical size can ratchet up over time.

The Fee Algorithm

Because capacity is elastic, fees are computed per byte from network conditions rather than bid in a blind auction. The reference wallet derives a base fee-per-byte from the block reward and the median weight, then multiplies by a priority tier (low → highest). In normal conditions this lands at a few cents regardless of the amount sent — and when demand spikes, blocks grow (within the penalty rules) instead of fees exploding. You met the user-facing side of this in Fees & Dynamic Block Size; this is the machinery underneath.

Block Reward & Tail Emission

The block reward followed a smooth emission curve until May 2022, when the main emission ended and a permanent tail emission of 0.6 XMR per block began. Tail emission (≈0.9% annual inflation at the switch, trending toward zero as a percentage forever) guarantees miners are always paid for securing the chain even after fees alone would be too thin — a deliberate security choice, not an accident. The exact circulating supply is auditable from the chain at any time (see Checking Network Stats).

You've Reached the Deep End

You now hold the real picture: a prime-order curve and four keys; stealth addresses via ECDH; CLSAG ring signatures with key images; RingCT with Pedersen commitments and Bulletproofs+; a byte-level transaction; and RandomX with an elastic, penalty-bounded block weight and fee. There's more frontier still — Seraphis/Jamtis (a proposed next-gen address and tx protocol), full-chain membership proofs (FCMP++) to replace ring signatures with a chain-wide anonymity set — but you're now equipped to read the research itself. Now take the expert quiz.