strk20.json

{
  "project": "Prova Pass",
  "tagline": "A capability layer for STRK20 pool activity: prove something about a wallet's public deposit history, redeem a one-time, value-bearing capability from any wallet.",
  "repo": "https://github.com/levithefirst/provah",
  "network": "mainnet",
  "chain_id": "SN_MAIN",
  "transactions": [
    "0x0684bdad671fb81afe3cc2c27038e867e352e3323f666e4fd967e0086fffc385",
    "0x0043faa1484457b0e5b97b860c5b9e1fdc6a5711dece60554bc8149b0b27adb6",
    "0x0613601df1f0057935ada6df4657962f853ba2b023e733886e2d3a5c95504421",
    "0x003c48357164e2536e57798787e9710b8025bdd4a083d10a5af2447e6fdd9473",
    "0x266ff30feda87e59c13eeccf122af1d82aaf92088d95cf7dcbff91f44c3c010",
    "0x1d57d647ff240ff4c02d9fb255bbaf80bc5238f8091483f33505c0ca3011153",
    "0x79375d773a91d5726a9bf896e114bc7549003f05c7decd685a0bce5b47dc70a",
    "0x758de909a13df099cd72a1ef843217805d04ab761ab57e2bcd4c0f924c126e6",
    "0x5ebf464f06bfe864f2ee875a4b8a84ab8032b31ced539300424067ae14f9dce",
    "0x41c16869dcd1f3781e839f44b9ea86b867d872f4177e7790fee631d957de9b3",
    "0x12aa67bcb97507d402cbe8a7308fd9a6c7ad3a9088227e4a35ad96603284496",
    "0x76eeb4941bda080592816c3c51ca92da65c20de18c48e7d4782e90010927625",
    "0x1a64f5d8963b89118464d4613511b7f65eeb8ffb12f52df887e25404e5b32c0",
    "0x45f6b0d60d1ef2b232885a416f562c16aea15365ea215efdd0db10c4da514c",
    "0x4e09d659241d884664dcd3d7e12c4815463fd2b4242a51c9d13f7bc87a8ffee"
  ],
  "_transactions_note": "This flat array of plain hash strings is the exact shape scripts/build-projects.mjs (starkience/strk20-hackathon) reads from a project's own strk20.json to verify mainnet activity: verifyTransactions() only accepts `typeof raw === 'string'` entries and only inspects the first 10 (`declared.slice(0, 10)`), so the 4 hashes that actually touch the STRK20 pool contract (POOL_ADDRESS 0x040337b1af3c663e86e333bab5a4b28da8d4652a15a69beee2b677776ffe812a) are listed first to guarantee they're checked. Rich, human-readable detail for every hash here lives in transactions_detail (the 11 ProvaPass-contract transactions) and strk20_pool_transactions (the 4 pool-contract transactions) below — this array intentionally strips that detail to match the parser's required format, not to remove it from the project record.",
  "transactions_detail": [
    {
      "type": "deploy_account",
      "hash": "0x266ff30feda87e59c13eeccf122af1d82aaf92088d95cf7dcbff91f44c3c010",
      "description": "Deploy Prova's operating account (OpenZeppelin single-signer, no guardian) on Starknet mainnet."
    },
    {
      "type": "declare",
      "hash": "0x1d57d647ff240ff4c02d9fb255bbaf80bc5238f8091483f33505c0ca3011153",
      "description": "Declare the ProvaPass Cairo contract class on Starknet mainnet."
    },
    {
      "type": "deploy",
      "hash": "0x79375d773a91d5726a9bf896e114bc7549003f05c7decd685a0bce5b47dc70a",
      "description": "Deploy the ProvaPass contract instance on Starknet mainnet."
    },
    {
      "type": "invoke",
      "entrypoint": "create_campaign",
      "hash": "0x758de909a13df099cd72a1ef843217805d04ab761ab57e2bcd4c0f924c126e6",
      "description": "Create 'STRK Loyalty Drop' (predicate: held_since — deposited >= 1 STRK cumulatively, at least 7 days ago)."
    },
    {
      "type": "invoke",
      "entrypoint": "claim_with_prova_pass",
      "hash": "0x5ebf464f06bfe864f2ee875a4b8a84ab8032b31ced539300424067ae14f9dce",
      "description": "Claim a Prova Pass from a wallet unrelated to the one that satisfied the predicate, consuming the nullifier one-time on-chain."
    },
    {
      "type": "invoke",
      "entrypoint": "create_campaign",
      "hash": "0x41c16869dcd1f3781e839f44b9ea86b867d872f4177e7790fee631d957de9b3",
      "description": "Create 'STRK Holder Badge' (predicate: balance_threshold — deposited >= 1 STRK cumulatively, ever, checked against public Deposit events). Second live campaign, proving the platform is multi-predicate, not single-purpose."
    },
    {
      "type": "invoke",
      "entrypoint": "create_campaign",
      "hash": "0x12aa67bcb97507d402cbe8a7308fd9a6c7ad3a9088227e4a35ad96603284496",
      "description": "Create 'Active Depositor' (predicate: deposit_count — >= 1 deposit into the pool). Third live campaign, a distinct activity-based predicate type."
    },
    {
      "type": "invoke",
      "entrypoint": "transfer",
      "hash": "0x76eeb4941bda080592816c3c51ca92da65c20de18c48e7d4782e90010927625",
      "description": "Fund the deployed ProvaPass contract with 1 real STRK from the operating account, so it can actually pay out reward_amount on claim, not just record a claim."
    },
    {
      "type": "invoke",
      "entrypoint": "create_campaign",
      "hash": "0x1a64f5d8963b89118464d4613511b7f65eeb8ffb12f52df887e25404e5b32c0",
      "description": "Create 'STRK Welcome Reward' (predicate: balance_threshold, claim_kind: reward_token — deposited >= 1 STRK cumulatively, ever; redeem pays 0.05 real STRK). Fourth live campaign: proof that redeeming a Prova Pass can move real value, not just record a claim."
    },
    {
      "type": "invoke",
      "entrypoint": "claim_with_prova_pass",
      "hash": "0x45f6b0d60d1ef2b232885a416f562c16aea15365ea215efdd0db10c4da514c",
      "description": "Redeem a 'STRK Welcome Reward' pass to a brand-new, never-before-used address. Verified via balanceOf: the recipient's STRK balance went from exactly 0 to exactly 50000000000000000 wei (0.05 STRK) in this transaction, alongside the usual nullifier consumption. Operator-attested for verification (see STATUS.md); the reward-payout mechanism itself (IERC20.transfer in claim_with_prova_pass) is live for any real user going through /api/pass and /api/claim."
    },
    {
      "type": "invoke",
      "entrypoint": "create_campaign",
      "hash": "0x4e09d659241d884664dcd3d7e12c4815463fd2b4242a51c9d13f7bc87a8ffee",
      "description": "Create 'Capability Smoke Test' (predicate: deposit_count with a minimum of 0 — satisfied by every address, including a brand-new one with zero STRK20 pool history). Fifth live campaign: added so the capability primitive itself (generate -> claim -> verify) is testable by anyone with a Starknet wallet, without first needing real pool activity. Pays no reward; proves nothing private about the connecting wallet."
    }
  ],
  "strk20_pool_transactions": [
    {
      "type": "invoke",
      "hash": "0x0684bdad671fb81afe3cc2c27038e867e352e3323f666e4fd967e0086fffc385",
      "network": "mainnet",
      "block_number": 13929673,
      "finality_status": "ACCEPTED_ON_L1",
      "execution_status": "SUCCEEDED",
      "voyager_url": "https://voyager.online/tx/0x0684bdad671fb81afe3cc2c27038e867e352e3323f666e4fd967e0086fffc385",
      "pool_contract": "0x040337b1af3c663e86e333bab5a4b28da8d4652a15a69beee2b677776ffe812a",
      "pool_events_emitted": ["ViewingKeySet", "Deposit", "EncNoteCreated"],
      "deposit_amount_wei": "10000000000000000000",
      "registered_user_addr": "0x011c79a4697d55de8df336b0ce9cb832af6ef442373f41c479a6af4c8a0cf258",
      "description": "A real 'enable private tokens' (viewing-key registration + shield) mainnet transaction against the live STRK20 privacy pool contract itself, completed by the team through a privacy-enabled wallet (the Wallet API route documented in the hackathon repo's docs/MAINNET-DAY-0.md, distinct from the app-holds-its-own-prover-key route this project's own attempts confirmed is blocked). Verified independently via this repo's own tx-status diagnostic (scripts/mainnet-admin.mjs), not taken on the submitted hash's word: finality ACCEPTED_ON_L1, execution SUCCEEDED, and the pool contract's own address as the emitter of ViewingKeySet, Deposit (10 STRK, matching a documented real-world reference shield of the same size), and EncNoteCreated in one call. This was the first of the project's real, direct pool-touching transactions."
    },
    {
      "type": "invoke",
      "hash": "0x0043faa1484457b0e5b97b860c5b9e1fdc6a5711dece60554bc8149b0b27adb6",
      "network": "mainnet",
      "block_number": 13955923,
      "finality_status": "ACCEPTED_ON_L2",
      "execution_status": "SUCCEEDED",
      "voyager_url": "https://voyager.online/tx/0x0043faa1484457b0e5b97b860c5b9e1fdc6a5711dece60554bc8149b0b27adb6",
      "pool_contract": "0x040337b1af3c663e86e333bab5a4b28da8d4652a15a69beee2b677776ffe812a",
      "pool_events_emitted": ["Deposit", "EncNoteCreated"],
      "deposit_amount_wei": "10000000000000000000",
      "registered_user_addr": "0x011c79a4697d55de8df336b0ce9cb832af6ef442373f41c479a6af4c8a0cf258",
      "description": "A second real shield into the live STRK20 privacy pool, from the same team-operated privacy-enabled wallet as the first pool transaction, via the same Wallet API route (submitted through Argent). Verified independently via this repo's own tx-status diagnostic: finality ACCEPTED_ON_L2, execution SUCCEEDED, and the pool contract's own address as the emitter of Deposit (0x11c79a4697d...cf258 depositing exactly 10 STRK, matching the first shield's size) and EncNoteCreated. The same transaction also relays a further ~6 STRK through an intermediate contract to other addresses, which this project has not further decoded; only the pool's own Deposit/EncNoteCreated events are claimed as verified pool activity here."
    },
    {
      "type": "invoke",
      "hash": "0x0613601df1f0057935ada6df4657962f853ba2b023e733886e2d3a5c95504421",
      "network": "mainnet",
      "block_number": 13955965,
      "finality_status": "ACCEPTED_ON_L2",
      "execution_status": "SUCCEEDED",
      "voyager_url": "https://voyager.online/tx/0x0613601df1f0057935ada6df4657962f853ba2b023e733886e2d3a5c95504421",
      "pool_contract": "0x040337b1af3c663e86e333bab5a4b28da8d4652a15a69beee2b677776ffe812a",
      "pool_events_emitted": ["Deposit", "EncNoteCreated"],
      "deposit_amount_wei": "10000000000000000000",
      "registered_user_addr": "0x011c79a4697d55de8df336b0ce9cb832af6ef442373f41c479a6af4c8a0cf258",
      "description": "A third real shield into the live STRK20 privacy pool, same wallet and route as the previous two. Verified independently via this repo's own tx-status diagnostic: finality ACCEPTED_ON_L2, execution SUCCEEDED, pool contract emitting Deposit (10 STRK) and EncNoteCreated. Same caveat as the second transaction regarding an additional undecoded ~6 STRK relay in the same call."
    },
    {
      "type": "invoke",
      "hash": "0x003c48357164e2536e57798787e9710b8025bdd4a083d10a5af2447e6fdd9473",
      "network": "mainnet",
      "block_number": 13956048,
      "finality_status": "ACCEPTED_ON_L2",
      "execution_status": "SUCCEEDED",
      "voyager_url": "https://voyager.online/tx/0x003c48357164e2536e57798787e9710b8025bdd4a083d10a5af2447e6fdd9473",
      "pool_contract": "0x040337b1af3c663e86e333bab5a4b28da8d4652a15a69beee2b677776ffe812a",
      "pool_events_emitted": ["Deposit", "EncNoteCreated"],
      "deposit_amount_wei": "10000000000000000000",
      "registered_user_addr": "0x011c79a4697d55de8df336b0ce9cb832af6ef442373f41c479a6af4c8a0cf258",
      "description": "A fourth real shield into the live STRK20 privacy pool, same wallet and route as the previous three. Verified independently via this repo's own tx-status diagnostic: finality ACCEPTED_ON_L2, execution SUCCEEDED, pool contract emitting Deposit (10 STRK) and EncNoteCreated. Same caveat as the second transaction regarding an additional undecoded relay in the same call. Together with the first pool transaction, this brings the count of independently-verified, direct STRK20 pool-touching transactions to 4, exceeding the >=3 requirement."
    }
  ],
  "contracts": [
    {
      "name": "STRK20 privacy pool (StarkWare, existing)",
      "address": "0x040337b1af3c663e86e333bab5a4b28da8d4652a15a69beee2b677776ffe812a",
      "network": "mainnet"
    },
    {
      "name": "ProvaPass",
      "address": "0x74614e0cd54af7e59987a5d74fdd028209feff01fc20eca2934fe80b94db402",
      "class_hash": "0x7adfeaf0d075cda33b3128fd9cc255e34e7b778e907cbb64216d76bd7cf89e6",
      "network": "mainnet"
    }
  ],
  "campaigns": [
    {
      "id": "0x2df11a90c5a246beb0c7b59cc13e3d73e3c7ae1de5a00f9d71bee9fb2720582",
      "name": "STRK Loyalty Drop",
      "predicate_type": "held_since"
    },
    {
      "id": "0x20b46e7e999cbcc1dc3b2d30368977a2782270c7434e3ef35ce18fc755188f1",
      "name": "STRK Holder Badge",
      "predicate_type": "balance_threshold"
    },
    {
      "id": "0x3d1270c552a597e11aaec052b7c8791a76fbb77ed946f36ffa7ba73325d35c3",
      "name": "Active Depositor",
      "predicate_type": "deposit_count"
    },
    {
      "id": "0x3955f5ac939b8318744dcb640107c9e2801d2140e65d6e7c1f083b8792d3720",
      "name": "STRK Welcome Reward",
      "predicate_type": "balance_threshold",
      "claim_kind": "reward_token",
      "reward_amount_wei": "50000000000000000"
    },
    {
      "id": "0x5ce82ce67493bfbbf1821517e2194a9fdfb7f8d46ba651931eb136e9d239a4",
      "name": "Capability Smoke Test",
      "predicate_type": "deposit_count",
      "predicate_min_amount": "0",
      "note": "Always-eligible open-access campaign — no STRK20 deposit required. Exists for public testability of the capability primitive, not to claim anything private."
    }
  ],
  "features": {
    "destination_binding": "A pass can optionally be locked to one destination wallet at issuance (bound_recipient), instead of the default pure-bearer model. /api/claim rejects any other recipient with 403 before the attester ever signs. Additive, opt-in, does not change the unlocked path.",
    "client_side_verification": "The app independently verifies claims from the browser's own public RPC connection, not through Provah's backend: is_nullifier_consumed read directly on ProvaPass after a claim, and STRK balanceOf diffed before/after for reward campaigns to show the exact payout observed on mainnet.",
    "client_side_eligibility_self_check": "Eligibility is independently re-derived client-side, from the same public Deposit events Prova's server reads, the moment a wallet connects and before /api/pass is ever called. Same predicate logic (src/lib/predicate.ts ported to ProvaApp.tsx), run in the browser against public RPC, so the server's yes/no verdict is reproducible by anyone, not just asserted.",
    "issuance_hygiene": "For reward campaigns (reward_amount > 0): prova_passes.address_commitment = pedersen(address, campaignId), no salt, unique per (campaign_id, address_commitment); /api/pass rejects a second pass request for a wallet that already holds one for that campaign (409), closing a gap where varying the client-supplied salt could mint unlimited passes draining the reward pool from one wallet. For non-reward, capability-only campaigns (e.g. the Capability Smoke Test) there is nothing to drain, so this limit doesn't apply — the same wallet can Generate repeatedly, each with its own nullifier. Nullifier uniqueness (no pass claimed twice) is unconditional either way.",
    "bounded_reward_exposure": "Reward campaign cards show the ProvaPass contract's live STRK balance, read client-side from public RPC. Since claim_with_prova_pass can never pay out more than the contract holds, this is a real, on-chain-verifiable upper bound on what a dishonest attestation could ever cost, not an assertion.",
    "defensive_expiry_check": "/api/claim now rejects an expired pass (410) before relaying a transaction, instead of relying solely on the Cairo contract's own on-chain expiry assert (prova_pass.cairo) and burning gas on a guaranteed revert."
  },
  "demo_video": "https://x.com/levithefirst/status/2093702890044952686",
  "_demo_video_note": "RESOLVED: recorded and posted; DEMO.md's script (90s-3min, three beats: smoke-test flow for any wallet, real-predicate flow with a visible STRK balance delta, optional destination-lock fail-then-succeed) was used as the basis.",
  "_pool_tx_requirement_note": "RESOLVED: >=3 mainnet transactions that touched the STRK20 pool contract were required; 4 are now verified in strk20_pool_transactions above, each independently confirmed via this repo's own tx-status diagnostic (finality + execution status + the pool contract's own address as event emitter), not taken on the submitted hashes' word. All four were completed by the team through a privacy-enabled wallet's Wallet API (Ready/Braavos via Argent) — this project's own backend still cannot submit pool transactions directly; see STATUS.md, 'Still needed for >=3 pool txs', for why.",
  "demo_url": "https://provah.vercel.app"
}