Carbon-Gauntlet

Fake carbon credits cost the climate. Carbon Gauntlet uses an AI verifier and a blockchain registry to stop them before they exist. We unleashed AI cheaters on it. None got through.

Comment

Inspiration

Carbon credits only work if each one is a real tonne of CO₂ removed or avoided. Often it isn't. A 2023 study in Science found only ~6% of credits from 18 forest projects matched real emission cuts. The common tricks are simple: the same land claimed twice, copied audit reports, inflated tonnes, retired credits resold, and two countries counting the same tonne. Human audits take months.

I asked: what if AI attacked a carbon market first, so we could build defences that hold?

What it does

Carbon Gauntlet checks every claim before credits are created.

  • AI verifier: investigates each project like an auditor. It checks the auditor registry, land overlap, copied and near-copied evidence, realistic tonnes, developer history, and hidden instructions (prompt injection).
  • Blockchain registry: a smart contract on Base Sepolia enforces the rules. No minting without approval or above the approved amount, no reselling retired credits, no cross-border sale without a corresponding adjustment (Paris Agreement, Article 6).
  • The Arena: four Claude agents, one honest and three cheaters, play six rounds in two markets: open (no checks) and protected (Carbon Gauntlet).
  • Try to cheat it: anyone can play the attacker with six tricks.
  • Permanent records: every live run is saved with its own link, and its SHA-256 fingerprint is anchored on-chain. Anyone can verify it in the browser.

Integrity score:

$$\text{Integrity} = 100 \times \left(1 - \frac{\text{credits at risk}}{\text{credits issued}}\right)$$

Recorded live run: open market 16/100, protected 100/100. 12 attacks blocked, 0 frauds accepted, 0 honest claims blocked.

How I built it

  • Smart contract: Solidity CreditRegistry (Hardhat), deployed and verified on Base Sepolia, in two modes: strict and open.
  • AI: Claude via the Anthropic API. Attacker agents plan, act and replan after being blocked. The verifier runs a tool-use loop with 7 checks.
  • Guardrails: model output is validated with Zod. Rule checks can only make the verifier stricter, and any HIGH-risk flag blocks approval.
  • Backend: Node, Express and TypeScript, with Server-Sent Events streaming each move live, and viem for chain writes.
  • Frontend: React, Vite and Leaflet, with animated agents, side-by-side markets and a site map.
  • Storage: Supabase for saved runs. Each run's fingerprint is anchored with anchorRun() on-chain.
  • Hosting: Vercel (web) and Render (API).
  • Tests: 61 API tests, 8 contract tests, and a 12-case verifier evaluation (12/12).

Challenges I ran into

  • Lagging blockchain nodes: public RPC nodes returned stale state, so valid transactions looked rejected. We fixed it by pinning reads to our latest block, adding retries, and tracking nonces locally.
  • AI is unpredictable: live runs differ every time. We record runs and replay them for free, and keep live runs behind an access code with a daily cap.
  • Trusting AI decisions: a model can be fooled or wrong. Deterministic rules sit under the AI, it can't approve high-risk claims, and unclear cases go to review.
  • Prompt injection: cheaters hid instructions in evidence. The verifier flags them as manipulation attempts.
  • Verifiable records: JSON key reordering broke hashes, so we store the exact text and hash that.
  • Explaining it simply: turning contract rules and AI checks into something a non-expert understands in 30 seconds.

Accomplishments that I am proud of

  • AI attackers invented new tricks we never scripted, such as cloning paperwork onto shifted plots, and the protocol still blocked them all.
  • Every claim shows the verifier's reasoning step by step, so it's not a black box.
  • Anyone can check a run against the blockchain from their own browser.
  • It's a working, deployed product, not just slides.

What I learned

  • Adversarial testing finds loopholes faster than writing rules by hand.
  • AI works best as a first-line investigator, with hard rules and humans as the final check.
  • A blockchain can enforce rules on records, but it can't prove a forest exists. Data quality still matters.
  • Reliability work (retries, fallbacks, caps) takes as long as features.

What's next for Carbon Gauntlet

  • Real data: public registry documents, satellite forest maps, accredited auditor lists.
  • A pilot: screen past projects from a public registry and compare against known problem cases.
  • A public API so registries and auditors can screen projects directly.
  • Shared control: multi-signature contract ownership by registries, not one operator.
  • Human review dashboard for flagged claims.

Built With

Share this project:

Updates

Submission history