Rastro

Rastro's opening screen, over a real Sentinel-2 satellite image of São Félix do Xingu, the town with Brazil's largest cattle herd.
The problem: buyers check only the last seller, so cattle from illegally cleared land pass through a "clean" middleman and look legal.
How it works: permits come in, AI traces each lot back through every farm, and a shared ledger enforces the rules for every buyer.
Every ranch is rated against real forest-loss data (INPE PRODES), Indigenous land, protected areas and embargoes. Ranches are simulated.
Today's check passes this ship. Rastro fails it: 51% of its cattle trace back to flagged ranches.
Tracing one export ship to Türkiye: the flow shows which ranches its 550 cattle really came from, farm by farm.
On test worlds we never tuned on, Rastro flags about 7 in 10 laundered cattle vs 1 in 6 for today's check, and blocks fewer honest herds.
All 36 live-export voyages pass today's check. Rastro fails 34 of them.
One shipment under investigation: the lineage graph shows where its cattle were born and every farm they passed through.
Why this shipment was flagged: each risk with its share of cattle, and every finding with its evidence in plain language.
The investigator console: what Rastro checked, flagged shipments and the review queue.
Try to cheat: the smart contract refuses reused certificates, flagged lots sold as clean, embargoed-ranch shipments and invented calves.
Anyone can verify a clean-lot certificate: 11 checks on the evidence, the signature and the blockchain, all read-only.
The live map: simulated ranches over real deforestation (pink), Indigenous lands and protected areas.

Inspiration

Cattle ranching is the biggest driver of deforestation in the Amazon. Brazil already has rules against it. Meatpackers must not buy cattle from illegally cleared land. But they only check the ranch that sold them the animals, not the ranches before it.

So the cattle get "laundered". A calf is born on illegally cleared land. It is sold to a clean-looking middleman ranch and resold a few days later. By the time it reaches the slaughterhouse or an export ship, its paperwork looks legal. Human Rights Watch traced illegal ranches into a major meatpacker's supply chain exactly this way in October 2025.

Three facts made this urgent for us:

Pará has postponed tracking individual animals until 2030.
The EU Deforestation Regulation covers beef from 30 December 2026.
Pará ships more than half of Brazil's live cattle, and Türkiye, the host of COP31, is Brazil's largest live-cattle buyer.

The information needed to catch laundering already exists. Every movement of cattle in Brazil needs an animal transit permit (a GTA). In October 2025 a federal court ruled that Pará must make this data public. What is missing is a neutral way for competing buyers to use it together. That is what we built.

What it does

Rastro checks where cattle really came from, not just who sold them.

It traces every lot back to birth. Rastro follows the permits backwards, farm by farm, and tells a buyer what share of a delivery or an export ship came from risky ranches: land cleared after 2020 (real INPE PRODES satellite data), Indigenous land, protected areas or embargoed ranches.
It finds the launderers with AI. Five detectors look for warning signs: forest cleared after the cut-off, more calves than a herd could produce, middlemen that resell cattle almost immediately, pastures holding more animals than they can feed, and unusual trading patterns (an IsolationForest model). Every finding stores its numbers and a plain-language reason.
Fixed rules decide, and people review the unclear cases. Each shipment gets PASS, REVIEW or FLAGGED. Anything uncertain goes to a human investigator. It never goes straight to PASS.
A shared blockchain ledger refuses impossible paperwork. The HerdLedger smart contract refuses a permit for more animals than a ranch holds, births beyond what its cows can produce, a permit used twice, and any movement out of an embargoed ranch. The rules hold for every buyer at once, so a refused permit cannot be taken to another company.
Clean lots get a certificate that works only once. A clean lot receives a signed certificate. It can back exactly one export or one EU due-diligence statement. Using it a second time is refused on-chain.
Anyone can verify a certificate. The console re-checks the evidence, the signature and the ledger: 11 checks, all read-only. Only salted hashes go on-chain, so no personal data is exposed.

Results (on 11 test worlds we never tuned on, with simulated ranches on the real landscape of São Félix do Xingu):

Rastro flags about 7 in 10 laundered cattle (68%), and sends 9 in 10 (91%) to a flag or a human review. Today's check catches about 1 in 6 (16%).
It wrongly stops fewer honest herds: 15% against 23% for today's check.
When launderers get smarter (holding cattle for months and hiding behind two middlemen), it still flags 70.6%.
All 36 live-export voyages in three years pass today's check. Rastro fails 34 of them. One ship to Türkiye carried 51% cattle from flagged ranches.
The ledger alone refused more than 27,000 head of "paper cattle": 13,542 head shipped from ranches that did not hold them, 13,234 impossible births and 883 head from embargoed ranches.

Who it is for: environmental regulators (Ibama and federal prosecutors), meatpackers and live-cattle exporters, EU importers who need EUDR proof, importers in Türkiye, Egypt and Iraq, and banks that lend to ranchers.

How we built it

Real data: INPE PRODES deforestation maps (2008–2025), Indigenous lands and protected areas, the IBGE herd count for São Félix do Xingu (2.73 million head, the largest in Brazil), Trase slaughterhouse and port locations, and a Sentinel-2 satellite image.
Simulated data: permit data is not public yet, so we wrote a generator that places 409 ranches on the real landscape, with herds, births, about 10,800 permits over three years, and hidden laundering. The answers are kept in a separate file that the detectors never read. Everything simulated is labelled in the app.
AI (Python): a geospatial engine (GeoPandas, Shapely), multi-hop lot tracing, five detectors including a scikit-learn IsolationForest, and an evaluation harness with 12 worlds and a held-out test seed.
Blockchain: the HerdLedger smart contract in Solidity with OpenZeppelin, signed EIP-712 certificates, and 227 Foundry tests including 12 invariant tests, with 100% line and branch coverage. It runs on a local Anvil chain.
Backend: a read-only FastAPI service that holds no private keys.
Web: React, TypeScript and MapLibre: a public site that tells the story, and an investigator console with lineage graphs, risk breakdowns, a live map and certificate checks.
Tests: 492 automated tests across the pipeline, API, contract and web, plus browser end-to-end checks.

Challenges we ran into

Keeping the evaluation honest. Our first detector looked almost perfect, but only on the world we built it on. We rebuilt the test with 12 worlds, a held-out seed and harder cheating patterns, and we report the lower, honest numbers.
Not blocking honest ranchers. Early versions spread suspicion over whole herds and failed most clean lots. Tracing at the level of each lot, a 25% blocking threshold and a review band for unclear cases brought false blocks down to about 12–15%.
Privacy versus transparency. Pará objected to publishing permits because of Brazil's data-protection law. Our ledger stores only salted hashes and counts, never names.

Accomplishments that we're proud of

The smart contract and the off-chain replay agree to the exact animal: 385,912 opening herd + 236,221 births = 315,096 sent to slaughter or export + 307,037 still on ranches.
Every decision can be traced to its evidence, and every certificate can be checked by anyone without trusting us.
We published where Rastro fails instead of hiding it.

What we learned

A blockchain alone cannot see a cow, and AI alone cannot make competitors share one rulebook. Rules based on physics, kept on-chain, catch the impossible. AI catches what is possible but suspicious. Sending unclear cases to a person is what makes the system usable for regulators.

What's next for Rastro

Connect real permit data as Brazilian states publish it, starting with Pará after the October 2025 court ruling.
Treat missing records as "needs review" instead of "blocked". This is our weakest case today: with 10% of permits missing, too many clean lots get flagged.
Deploy HerdLedger to a public testnet, add a multi-party oracle (regulator plus auditor), and enforce the export binding inside the contract.
Pilot with one exporter on one live-export route, and with an EU importer preparing EUDR statements.