MethaneClause

Inspiration

IEEE ClimateChain Global Hackathon 2026 — Track 4: Climate Data & Environmental Monitoring (secondary: Track 1)

UNEP's Methane Alert and Response System has issued more than 5,000 satellite alerts across 33 countries and helped trigger more than 40 verified repairs — yet only 13 % of alerts receive a response (UN News, 23 Jul 2026). An alert pays no one, and even an answered one moved nothing we can measure: in our event study, Carbon Mapper's detection rate changed by −0.020 where the operator or government answered, relative to where nobody did (95 % CI −0.105 to +0.066). At the same time, gas buyers write "no super-emitters" into supply contracts and have no executable remedy when it happens.

The gap is visible in public data. UNEP MARS lists source TKM_S_276 (Turkmenistan) as absent; Carbon Mapper observed the sources within 1.5 km of it on 9 passes since MARS's last plume (13 Jun 2025) and recorded a plume on all 9, including 2,548 kg/h on 2026-06-11. Across our frozen join of the two datasets, 203 of 1,122 MARS-absent oil and gas sources had a Carbon Mapper plume within 1.5 km inside MARS's own window (criterion).

And the buyers now need this: from 1 Jan 2027, EU gas importers must show that gas bought under contracts concluded or renewed since 4 Aug 2024 is under producer-level monitoring, reporting and verification equivalent to the EU's (Regulation (EU) 2024/1787, Art. 28).

We wanted the satellite alert to move money.

What it does

MethaneClause is a speed camera for methane, written into the gas contract between an EU gas importer and its supplier.

The seller posts a bond for the named sources it supplies from. Public satellite records are the cameras. Independent witnesses — separate observer organisations that both parties name in the clause, controlled by neither, paid a fee per counted pass — each fetch the Carbon Mapper record, seal it (RFC 8785 + SHA-256) and sign it. Seen → confirmed → paid. When k of n witnesses (2 of 4 in the clause design) sign the same leak and the appeal window passes, the contract pays the buyer from the seller's bond. The ticket goes to the buyer, not to a state. Clean passes → earn-back in steps. Qualified clean satellite passes earn the seller money back from a sponsor's pool (a lender's sustainability-linked margin step, or the buyer keeping a clean supplier) — never more than the rebate. New leak → earn-back stops. The next confirmed leak cancels every unpaid step. A clean pass never undoes a paid rebate or counts as a repair. No one runs the payout. Once enough independent witnesses sign the same sighting and the appeal window passes, the contract pays. The seller can appeal — then the witnesses must confirm it again — but cannot delete the sighting or hold the money.

Who gains what

Buyer (the methane desk of an EU gas importer): an executable remedy plus the IEA Annex D evidence file and a credit note it can file — no internal system is replaced (parallel run). Seller: keeps the buyer, shows a bonded commitment that buyers and lenders can check, and earns part of the rebate back with clean passes. Sponsor / lender: pays only for satellite-verified clean passes. The climate: a methane alert finally carries a price for the source that emits. Settlement is chosen per jurisdiction: on chain where lawful, or as a credit note under the supply contract where crypto payments are not (a Türkiye-type importer runs verdict-only). The verdict is the same either way.

Why a blockchain

The organizer's four-question test, answered:

Multiple parties? Seller, buyer, a sponsor, k of n observer organisations named in the clause (n ≥ k + 2; none is the seller's or the buyer's), open challengers. No trusted operator? None exists for this function. Registries (MiQ, JOGMEC CLEAN, UNEP MARS) certify and notify but cannot move a seller's money; a bank can move money but cannot adjudicate satellite evidence; a court can do both and takes years. Seller and buyer are counterparties: neither accepts an operator chosen by the other, so the decision has to come from k independent observers plus an open challenge window — which is what the contract executes. Outside verification? Anyone can re-fetch Carbon Mapper, recompute the canonical bundle hash and challenge an episode or a clean pass with an objective reason code. Fits the ledger? Only hashes, IDs and money go on chain: evidenceHash, sceneHash, policyHash, a Merkle root of covered facilities, the bond, the pool. Raw data stays with the providers and the observers. How we built it Contracts: Solidity 0.8.37 on Foundry — the v1 core (KeyRegistry, MethaneCovenant, EIP-712 attestations) kept byte-identical and checked on every build; an IncentivePool for the earn-back side; a SuretyBond for a surety-posted bond. Unit, invariant, hostile-receiver, replay and key-compromise tests; Slither in CI. Observers: Python 3.12 — keyless fetch of Carbon Mapper and UNEP MARS, validate, seal with RFC 8785 + SHA-256, sign EIP-712 with secp256k1 ECDSA (checked on chain) plus an ML-DSA-44 (FIPS 204, post-quantum) co-signature (checked off chain and in the browser), re-check. The page: a story map of the case, and a full page that re-checks every hash and signature in your browser — clause card, episodes, a tamper button, Annex D export with round trip, and a live Sepolia read. Live on Ethereum Sepolia, Etherscan-verified: MethaneCovenant, KeyRegistry (admin renounced), IncentivePool. The loop is closed on chain: the k-of-n episode on TKM_S_276 was finalized CONFIRMED after its appeal window (tx) and the buyer withdrew the rebate from the seller's bond (tx). A rejection you can open in an explorer: the same signed bundle with its rate edited — receipt status 0, InvalidSignature; the bond did not move (tx). AI assistance: Anthropic's Claude models wrote most of the code and documents under the author's direction in three parallel workstreams; independent reviewer agents read each result before it was accepted.

Challenges we ran into

Making non-detection mean something without letting it mean repair. A quiet run is weak evidence: in Carbon Mapper's catalogue the pass after three non-detections still saw a plume 22 % of the time (47/210). So the earn-back is capped at the rebate, paid in steps, frozen during review, and cancelled by the next confirmed leak. A clean pass counts only on a clear-sky scene, from an instrument that could see a leak this size, with no MARS plume within ±7 days. Holding our own numbers to account. Several of our figures did not survive adversarial review and were withdrawn (a 62 % re-detection rate, a 26 % independent-satellite share, a 25 % refund cap, upper-bound refund totals). The carbon projection was re-done as a pre-registered forward hold-out. Carbon Mapper sends no CORS header, so the page shows the observer's terminal receipt and re-checks it instead of fetching. Accomplishments that we're proud of Try to cheat it in 60 seconds: open the page with the tamper demo — edit the leak rate and the signatures fail in your browser; the bond stays. Become a witness yourself: your own test wallet signs as an observer in the judge sandbox on Sepolia (make judge-attest …), or make judge-local with no test ETH. make verify-evidence re-checks our Sepolia record with no key at all. One command, end to end: make setup && make test && make demo — no keys, no accounts. The demo runs a DZA replay (91 checks), the v1 TKM_S_276 loop with seven rejection paths (33 checks), a verdict-only importer (11 checks) and a 205-facility portfolio covenant (7 checks). Both sides of the clause have transactions on a public chain: a confirmed rebate paid out, and on the earn-back side a confirmed relapse, an opened claim and a first counted clean pass. Carbon, stated honestly. Stake, not abatement: ~0.5 Mt CH₄/yr (low bound) across 428 facilities. [PROJECTION] In a pre-registered forward hold-out, a 220-facility portfolio covenant [SIM] would stop ~3.4 kt CH₄/yr (95 % bootstrap ~0.9–6.5 kt), ~0.10 Mt CO₂e/yr at GWP-100 — 4.0 % of the ~84 kt CH₄/yr stake of its 115 members with a stake known at the start; assumptions in the paper's carbon projection section. The ledger costs USD 0.0055 per projected t CO₂e. What we learned A gradient-boosted next-pass forecast, measured against the frozen persistence rule on region- and time-held-out sets, scored Brier skill +0.037 and −0.0721: it did not beat the rule on both, so the product uses the rule (model card). The chain earns its place only for the multi-party verdict and the money that follows it — and that is exactly where no one else can do the job.

What's next

Independent institutions holding the keys of the registered observer organisations, plus one more organisation so a contest always keeps a spare witness (n ≥ k + 2). From projection to measurement: a real supply-contract pilot with an EU importer replaces both projection assumptions with its own record — the share of confirmed leaks followed by qualified clean passes (the action share) and, from those passes, an upper bound on how often the source still emits (the time share) — settled in a euro e-money token where lawful. A duty cycle measured on un-targeted EMIT passes, a cross-provider gate on core payouts, Merkle batching of attestations. The same two-sided clause for landfill methane. The path from this prototype to a signed clause, element by element: PRODUCTION.md. In the prototype, seller, buyer and sponsor are simulated parties [SIM], the observer keys are run by the author, the demo and Sepolia run a 2-of-3 quorum, the on-chain signature check is secp256k1 ECDSA, and amounts are representative test values; a production clause sets them in euros.

The paper (PDF, attached): §1 Problem p. 2 · §2 Solution and architecture p. 2 · §3 Security and data integrity p. 5 · §4 Carbon projection p. 6 · §5 Adoption p. 10 · §6 Scaling p. 12.

Code: https://github.com/ismailatilan-44/methaneclause · Live page: https://ismailatilan-44.github.io/methaneclause/

Built With

• carbon-mapper
• dilithium-py
• eth-account
• ethereum
• foundry
• leaflet.js
• noble-post-quantum
• python
• sepolia
• solidity
• unep-mars
• viem
• web3.py