Identity Prism

Your Solana identity, reimagined.

Comment

Inspiration

On Solana, your wallet already tells a rich story - but it's scattered, unverifiable, and trivially faked by sybils. We wanted to turn that raw on-chain history into a living identity you own: something you mint, grow, and actually use every day. So we built Identity Prism - a Solana identity and reputation layer wrapped in a game you come back to.

What it does

  • Mint your Identity as a Metaplex Core NFT that reflects your real on-chain activity and reputation.
  • Sybil-resistant scoring, so identities can't be cheaply farmed.
  • Prism League - three arcade mini-games (Orbit, Cosmic Defender, Gravity) with coins, revives, daily challenges and leaderboards, all fully server-verified.
  • On-chain economy - buy, stake and spend coins; pay for revives in SKR; commit results on-chain.
  • Native Android app with Solana Mobile Wallet Adapter and Seed Vault (built and tested on a Seeker).

How we built it

Frontend: React, Vite, Three.js and Tailwind, packaged as a native Android app with Capacitor. Backend: Node.js and SQLite, Solana web3.js and Metaplex Core, MagicBlock for provably-fair game seeds, MWA and Seed Vault for signing.

The core of our submission is what we did with Codex and GPT-5.6: we used GPT-5.6 (Codex CLI) as an adversarial security co-engineer to harden the entire game economy in a spec, build and red-team loop:

  1. Analyze - GPT-5.6 audited the revive, coins and leaderboard flow and surfaced concrete exploits (client-controlled coin deltas, forgeable scores, unauthenticated metadata exposure).
  2. Spec - it wrote a precise, staged implementation plan (schema, atomic settlement, on-chain payment verification).
  3. Build - Codex implemented server-authoritative timing, a server-derived coins model (the client coin delta is fully ignored), single-use session tokens, and on-chain SKR payment verification for paid revives.
  4. Verify - it then repeatedly red-teamed its own code across multiple rounds, each pass finding narrower bugs (a Number(null) timing bug, grant-ordering by UUID, a plaintext-token leak in a public route) until the money path was provably safe. All coordinated via Codex Session IDs and git history.

Challenges we ran into

  • Making a game economy cheat-proof without breaking honest players — our first pass wrongly rejected legitimate runs, so we had to separate a timing "grace" from the coin award.
  • On-chain payment verification for revives (parsing the SKR transfer, net-balance deltas, memo binding, replay protection) with a fast confirmed-commitment UX of about 1–2 seconds.
  • A subtle touch-only CSS bug (a[href] min-height 44px) that inflated a UI panel only on device, diagnosed by measuring the live DOM.
  • A real leaderboard bug where legitimate score-zero runs silently failed to record.

What we learned

Using GPT-5.6 as an adversary against its own implementation - not just a code generator — caught money-critical bugs a single pass never would. The most valuable pattern was the tight spec, implement and adversarial-verify loop, with the model rating each finding's severity so we could ship confidently.

What's next

Publishing to the Solana dApp Store, server-side gameplay proofs for a fully trustless leaderboard, and richer identity signals.

Built With

Share this project:

Updates