Hydrozoa and Gummiworm: Co-evolution and convergence

Gummiworm and Hydrozoa were developed in parallel over several years, each attacking a different set of Hydra’s limitations. This whitepaper describes the protocol that emerged when their authors realized each project had exactly what the other was missing.

Hydra and its constraints

The following describes Hydra as it existed in late 2022, when both Gummiworm and Hydrozoa were conceived. The Hydra team has since added incremental commits and decommits — the ability to deposit into and withdraw from an open head — though these are still processed one at a time. Work is also underway on a partial fan-out mechanism to address the closing bottleneck, where heads with large utxo sets can stall during finalization.

Hydra is a state channel protocol for Cardano that achieves high throughput by reaching unanimous consensus among a small set of peers. Within a Hydra head, participants can transact freely and rapidly, settling the final state back to the Cardano Layer 1 when they choose to close. The tradeoff is tight: all funds inside the head must belong to the head members themselves, the membership is fixed at the start, and the protocol can neither absorb new deposits nor disburse withdrawals while the head is open.

These constraints make Hydra a powerful tool for its intended use cases, but they limit its applicability to DeFi settings where participants are numerous, dynamic, and often unknown to each other. When external users deposit funds into a Hydra-based application, those users must trust the head operators not to collude against them — a trust assumption that grows increasingly fragile as the funds under management grow.

What Hydrozoa solved

Hydrozoa was conceived to address Hydra’s structural constraints directly. Its core insight was that a state channel need not freeze custody in place for its entire lifetime. Instead, the protocol treats the Layer 1 as a live interface: deposits arrive at a native script address while the head is open; settlement effects periodically absorb those deposits into the treasury and disburse pending withdrawals; a rollout mechanism handles payouts that would otherwise overflow a single transaction’s output limit.

This made continuous operation practical. Rather than requiring a full close-and-reopen cycle to admit new participants, a Hydrozoa head simply absorbs deposits during its next settlement. Withdrawals flow out via rollout chains, unconstrained by transaction size limits. The head is initialized with a single multisigned transaction — no multi-party ceremony required — and, if consensus fails, a pre-signed fallback transaction matures and shifts custody into a rules-based regime, where participants can individually evacuate their funds using KZG membership proofs against the last committed state.

Together, these innovations transformed the state channel from a closed arrangement into a live custody mechanism capable of serving an open, dynamic user population.

The custody problem remains

Hydrozoa’s improvements were substantial, but they did not change the fundamental trust model at the head level. Head peers were still unanimous signers: any one of them could stall the protocol, and all of them together could still sign a snapshot that misrepresented the ledger state. For a protocol handling external user funds at scale, this creates the same pressure Hydra faces: as the value under management grows, so does the incentive for head operators to collude.

What Gummiworm solved

Gummiworm was conceived independently, starting from the same observation about Hydra: that head operators performing both execution and custody creates an unacceptable trust assumption for external users. Its response was to make the separation explicit and structural. A small set of head peers executes transactions — sequencing them, signing block briefs, producing a fast-moving ledger — while a much larger, more decentralized coil validates those blocks and co-signs the L1 effects that actually move funds. Because absorbing deposits and disbursing withdrawals requires the coil’s threshold signature, head peers have no unilateral access to user funds.

Gummiworm also pushed further on the design frontier in ways Hydrozoa had not. The vision of inter-head transactions — allowing users to transact across multiple independent heads — and multi-L1 custody, where a single head manages funds from several blockchains simultaneously, were both developed as part of the Gummiworm design before the two projects merged.

The early Gummiworm specification documented this architecture in detail and had been in active prototyping for over a year. What it lacked was a concrete answer to the operational details: how settlements and withdrawals would be structured on-chain, how L1 effects would be managed, and what would happen if consensus broke down. It referenced Hydrozoa explicitly as the natural integration point — but the two projects had not yet joined forces.

Convergence

The two projects came together in August 2025, when their respective authors had a long conversation and realized they had been solving complementary halves of the same problem. Hydrozoa had built a robust operational substrate — settlement effects, rollout chains, a fallback mechanism, a rules-based regime, KZG evacuation commitments — that could serve as the L1 interface Gummiworm needed. Gummiworm had solved the custody trust problem that Hydrozoa faced but hadn’t addressed.

The merged design draws heavily from both. From Hydrozoa: the block type taxonomy (minor, major, final), the settlement and rollout effects, the post-dated fallback as a dead-man’s switch, the rules-based regime for dispute resolution, and KZG commitments for the evacuation map. A subsequent deep refactor of the Hydrozoa codebase — inspired by the Raft protocol — contributed the request ID scheme and sequential per-peer ordering that became central to Gummiworm’s censorship resistance model. From Gummiworm: the head/coil separation itself, the split of consensus into fast (head-only) and slow (head plus coil threshold) cycles, the multi-L1 custody framing, and the vision of inter-head communication through overlapping coils.

The result is a protocol neither project could have produced alone.