Orbit

• 

  Overview: the globe shows every city where a party signs and the routes products actually took, with the misdeclared air leg in red.

• 

  The 'EcoCloud' hoodie caught four ways: 70% recycled is really 6.7%, sea was really air, 13.4 kg CO2e, labour audit rejected. Grade E.

• 

  Independent verifier: your browser rebuilds the ledger, checks it against the chain, re-checks every signature and re-derives each verdict.

• 

  Insider attack caught: the failed audit is erased and history re-signed. Every local check passes; only the on-chain anchors disagree.

• 

  Honest ledger: all entries match checkpoints anchored on Base Sepolia by Orbit's operator and a witness. Try three tamper attacks below.

• 

  Architecture: actors sign each step, the server replays the rules, Merkle roots are anchored on-chain, and anyone's browser re-checks it.

Inspiration

A hoodie in a shop says "70% recycled, carbon neutral, ethically made." You can't check any of it. Neither can the regulator, and often neither can the brand's own buyers. The European Commission found that 53% of green claims were vague, misleading or unfounded, and 40% had no evidence at all. The EU is about to make digital product passports mandatory: for batteries from February 2027, with textiles to follow. Most passport projects store what the brand says. We wanted one that checks it. (Problem statement)

What it does

Scan the hoodie's QR code and Orbit's passport tells you:

Grade E, 0/100. The page shows every point gained and lost, so nobody has to take the score on faith. An honest T-shirt in the same demo gets an A.

The idea is simple: check the brand's claims against what someone else signed. Each party in the chain (supplier, factory, carrier, retailer, auditor, repairer, recycler) signs its own step with its own key. Orbit then works out recycled content, carbon and custody from those signatures, using public rules.

It covers the whole circular loop:

• Lifecycle tracking from fibre lot to recycler, with a journey map.
• Recycling traceability: a recycler signs the mass it recovered, which can't exceed what went in. Those recovered lots become a new battery with 93% recycled content, provable back to the original passport.
• Circular incentives: returning, repairing and recycling earn non-transferable credits, redeemable for repairs, transit top-ups or tree planting. In a real scheme the brand's EPR fee would fund them. Credits exist only because of a signed event.
• Check any claim: paste a line from any label. Orbit flags wording banned under EU Directive 2024/825 (like "eco-friendly" or "carbon neutral") and says what signed data it would need to check the rest.
• Join as yourself: become a consumer whose key is created in your own browser, then buy and return a product for its reward.

Why you can trust the passport

1. Orbit can't sign for anyone. Every step carries the actor's own signature. (In the demo, the server holds the role-play actors' keys; guests keep their own.)
2. Everything Orbit derives can be recomputed from those signatures.
3. A fingerprint of the whole history is anchored on a public blockchain (Base Sepolia). Witnesses can anchor it from their own wallets too (so far the only named witness is a second wallet of ours). If Orbit deletes the failed audit and rebuilds everything after it, the fingerprints stop matching. The Ledger page lets you try this attack live.
4. Your browser checks everything itself: it downloads the ledger, matches it to the on-chain fingerprint, re-checks every signature, confirms the passport leaves nothing out, and re-derives every verdict.
5. Then the contract checks it too. "Verify on-chain" sends the Merkle proofs to the deployed contract, whose own Solidity code confirms each event is in the anchored history and that history was only ever appended to. It must also reject a forged entry, so a "yes" means something. Free, read-only, no wallet.

Impact

If 5% of EU textiles and batteries carried Orbit-style passports by 2030, we project about 0.08 Mt CO₂e avoided per year (plausible range 0.01–0.25 Mt), mostly from longer textile life and more fibre-to-fibre recycling. One pilot (100,000 garments and 20,000 e-bike battery packs a year) would avoid about 48 t CO₂e a year. The biggest unknown is how many people actually repair. Every input is sourced in our impact assessment.

How we built it

• Next.js 15, React 19, TypeScript, Tailwind v4
• Ed25519 signatures: native Node crypto on the server, audited @noble libraries in the browser, tested to be byte-identical.
• Replay: the append-only ledger is the only stored state. All state is rebuilt by replaying the signed instructions through the same rules the API uses.
• Anchoring: RFC 6962 Merkle roots (the scheme behind Certificate Transparency), sent to our OrbitAnchor Solidity contract, source verified on Sourcify. Anyone can anchor; verifiers trust only Orbit's operator and named witnesses, pinned in code.
• Standards: passport exports validate against the official UNTP DPP 0.5.0 JSON schema. Data models follow GS1 EPCIS 2.0 / Digital Link, EU ESPR and Battery Regulation fields, and GLEC transport factors.
• 66 unit tests and 3 on-chain tests, run by CI on every push, covering signature attacks, operator forgeries, the erase-and-rebuild attack, and passports that omit or forge events. A differential test makes Solidity and TypeScript agree on every Merkle proof, honest and tampered, for every tree size up to 24 (over 1,000 contract calls).
• Static analysis: Slither (102 detectors) reports 0 findings on the contract.
• At 10,000 entries: a signed write takes about 0.7 ms; an anchor costs about 146k gas whatever the volume, roughly $0.002–$0.02 on Base mainnet.

Challenges we ran into

• The operator problem. A signed database can be rewritten by whoever holds the key. Outside reviewers attacked our early versions twice and found forgeable passports, unverified derived data, and passports that could leave events out. Each time we rebuilt the trust model and added a regression test.
• The oracle problem. Signatures prove who said something, not that it's true. Our answer is to make the other party supply the evidence: the recipient's arrival time, the supplier's lot, the auditor's verdict. We label what is still self-reported, such as factory energy. Our security assessment lists what remains possible.

Accomplishments that we're proud of

• The greenwashed hoodie is caught four ways, and the grade explains itself.
• The hardest insider attack (erase an audit, then rebuild all later history through the real rules) passes every local check and is caught only by the on-chain fingerprints.
• A closed loop: a recycled battery whose 93% recycled content is proven, not declared.
• The contract itself re-checks passports, and Solidity matches our TypeScript on every proof we threw at it.
• Lighthouse 100 for accessibility, best practices and SEO on all 7 pages (automated checks, not user testing).

What we learned

Traceability alone doesn't create accountability. Accountability comes from checking claims against data that someone other than the claimant signed, and from letting anyone, not just the operator, re-check the record.

What's next for Orbit

• User testing with shoppers and supply-chain staff
• Outside witnesses: auditors, recyclers, NGOs (witness guide)
• Actors' keys in their own wallets, with accredited onboarding
• Signed scale weights and carrier pickup signatures at every handover
• A pilot with one brand, measuring repair and return uptake first

Built With

• ajv
• anvil
• base
• blockchain
• ed25519
• ethereum
• foundry
• github-actions
• gs1-epcis
• json-schema
• merkle-tree
• next.js
• noble-curves
• node.js
• react
• render
• slither
• solc
• solidity
• sourcify
• tailwindcss
• typescript
• untp
• viem