Smart contracts you can read.
TCCL looks like Python — indented blocks, few keywords — but every value has a declared type, every step costs fuel, and the same code gives exactly the same result on every node of The Coin.
Free and open source (MIT or Apache-2.0). The playground runs the real engine in your browser — nothing is published.
cloud_coin.tccl# A fungible token in a few lines: the standard token module plus a minter role.
contract CloudCoin
use std.token
role minter
init(supply: int):
token.setup("Cloud Coin", "CLD", 8)
grant minter to caller
token.mint(caller, supply)
action mint(to: address, amount: int) only minter:
token.mint(to, amount)
action add_minter(who: address) only minter:
grant minter to who
action burn(amount: int):
token.burn(caller, amount)Start with one file
A contract is a single .tccl file. The compiler tells you what is wrong, where, why and how to fix it — in English, Portuguese or Spanish.
Readable by design
state, action, view, require, emit. No hidden conversions, no null, no floats: amounts are integers in motes.
Errors that teach
Every error has a line and column, a code like C006, an explanation and a suggested fix such as “did you mean total?”.
Test before you pay
tccl test runs plain-text scenarios; the playground shows state before and after, events and estimated fees.
Grow into payments, privacy, games and exchanges
Language version 2 adds what serious applications need, without making the simple things harder.
Records and named situations
record Order with typed fields; enum Status with allowed transitions checked every time a value is stored.
Explicit permissions
role manager, grant, revoke and only manager on actions. Wallets see who may call what.
Calls between contracts
interface Token and Token(addr).transfer(...). The callee sees the calling contract as caller; failures revert everything.
Standard library
use std.token, use std.items, use std.payments: tokens, unique items and conditional payments compiled into your contract.
Privacy where you need it
Linkable ring signatures (ring_verify) for private payment pools — with their limits documented, not hidden.
Upgrades with an authority
Contracts can be upgraded by their upgrade authority, or made final forever. Other contracts can check is_final(addr).
Protections the network always applies
They are part of the engine. No contract, flag or setting turns them off.
Deterministic
No clock, no floats, no randomness, ordered storage. Every node computes the same result.
Checked arithmetic
Overflow and division by zero stop the call. mul_div computes a × b ÷ c without intermediate overflow.
Fuel and memory limits
Every operation costs fuel; version 2 also limits memory to 16 MiB per transaction and prices copies per allocation.
No re-entrancy
A contract already running in a transaction can never be called again during it.
Atomic
If anything fails — in any contract — every change, payment and event of the transaction is reverted. The fee is still paid.
Tested against the network
Version 1 compiles byte-for-byte like the engine deployed on The Coin, checked on more than 10 000 programs.
What TCCL does not promise
TCCL is an interpreter written in Rust. Rust gives memory safety and predictable performance; it does not make contracts run at native speed. We publish our measurements instead of slogans.
Nothing computed on a public blockchain is secret or random by itself. Data from the outside world is only as trustworthy as whoever signs it. The documentation explains these limits and the patterns that work around them.