PlotLock

Track 4: Climate Data & Environmental Monitoring.

Inspiration

Every autumn, farmers across Haryana and Punjab have a short window between the paddy harvest and wheat sowing, and many clear their fields by burning the stubble. The smoke is a major seasonal air pollution event for Delhi-NCR, and the burning also releases methane and nitrous oxide, which count toward CO2e, plus fine particulate matter (PM2.5) that harms health directly. Governments now pay farmers not to burn: the Haryana state government offers an incentive of Rs 1,200 per acre for crop-residue management (announced September 2026). But a payment for "this field did not burn" is only as good as its verification. Today, a claim rests on paperwork and spot checks. Nothing stops the same land being claimed twice under a slightly redrawn outline, and nothing binds a no-burn claim to evidence that anyone can recheck later. PlotLock was built to close exactly that gap: one attestation per plot per season, bound to satellite evidence, recorded on-chain where anyone can replay it.

A note on the impact math, because we think it matters to get this right: the straw's own CO2 is biogenic and is not counted under IPCC accounting, so we do not count it either. The climate case rests on the methane and nitrous oxide from residue burning, counted as CO2e, and on the PM2.5 health harm.

What it does

PlotLock is a verification layer for seasonal no-burn claims, built for the people who pay and police them: a state residue-management incentive desk and pollution-control officers.

• A plot is registered for a season as a set of H3 map cells (small hex cells, about 300 m across), not as a freehand polygon ID.
• If any cell overlaps a plot already registered for that season, registration reverts on-chain. Redrawing the outline a few metres over does not help, because the cells still overlap.
• An off-chain oracle reviews satellite evidence for the plot and signs one of three verdicts: NoBurn, Burned, or Uncertain.
• The smart contract verifies the oracle's signature, a fresh nonce, and a deadline before it records anything. Only a NoBurn verdict records a payout-eligible attestation. Burned and Uncertain are recorded as rejected verdicts.
• One claim per plot per season. A second claim reverts.
• Uncertainty is a verdict, not a failure. If there is no clear evidence, nothing is paid.

How it works

The contract (contracts/PlotLock.sol, Solidity, OpenZeppelin) holds the H3 cell registry and the attestation logic. It enforces the overlap rejection (CellAlreadyTaken), the one-claim-per-season rule, and verifies EIP-191/ECDSA oracle signatures over a digest that binds the contract address, chain ID, plot ID, season, verdict, evidence hash, nonce, and deadline. It is deployed and live on the Polygon Amoy testnet.

The oracle (FastAPI, in oracle/) is the evidence pipeline. It evaluates two independent satellite signals:

1. NASA FIRMS/VIIRS active-fire detections (375 m) for fire activity in or near the plot.
2. Sentinel-2 burn-scar analysis (20 m, via Microsoft Planetary Computer) to confirm whether this specific field actually burned.

The verdict rule is deliberately strict: both signals must support the outcome. Missing or conflicting evidence returns Uncertain, and Uncertain never pays. The oracle signs verdicts with a server-side key; keys never reach the browser. A /verify endpoint lets anyone recompute the evidence hash and check a signature, which powers the tamper-evidence demo.

The map UI (web/, plain HTML/CSS/JS with Leaflet) shows the four demo plots on one page over Kaithal, Haryana, with verdict colours, evidence panels, provenance labels, and block-explorer links, so a judge can replay the whole story with no wallet and no API key.

Honesty about the evidence set. The demo runs on a curated fixture set so it never depends on a live API at judging time. Plot 1 (clean) and plot 3 (cloudy) use real Sentinel-2 pulls: real item metadata, real pre-fire imagery values, and real cloud-cover measurements. Plot 2 (burned) is partly mirrored and is labelled as such in the repo and in the UI: its scar metrics and FIRMS rows are mirrored in the exact shape of the real data, because a wide scan of the demo area found no persistent real burn scar in the window, and live FIRMS access needs a NASA MAP_KEY that we do not hold. We would rather label that plainly than present synthetic rows as real detections.

An honest limit. Absence of a satellite fire detection does not prove a field did not burn; fires can fall between overpasses or under cloud. PlotLock supports evidence review with a tamper-evident trail. It does not certify carbon credits.

The demo walkthrough

The demo video (and the map UI) walks through four plots around Kaithal, Haryana, for season 2026:

1. Plot 1, clean. Evidence is clear on both signals, verdict NoBurn. The plot is registered on-chain (108 H3 cells), the oracle signs the verdict, and the claim is submitted: a payout-eligible attestation is recorded on Polygon Amoy, with explorer links anyone can open.
2. Plot 2, burned. FIRMS flags fire activity and the Sentinel-2 scar analysis confirms burning, verdict Burned. No attestation, no payment.
3. Plot 3, cloudy. The Sentinel-2 window is clouded out (the two real acquisitions in the window measured 80.4% and 70.5% tile cloud), so the scar check is genuinely unavailable. Verdict Uncertain. Nothing is paid.
4. Plot 4, the redrawn duplicate. The same land as plot 1, redrawn about 51 m east and 36 m north. It still shares 65 of plot 1's 107 H3 cells, so registration reverts with CellAlreadyTaken. The same land cannot be claimed twice.

The walkthrough closes with the tamper-evidence demo: change one number in a recorded evidence bundle and the recomputed hash no longer matches the hash bound into the on-chain claim. The record itself tells you it was altered.

Challenges we ran into

• Two satellites, two failure modes. FIRMS sees heat, not scars, and can miss short burns between overpasses; Sentinel-2 sees scars but is blind under cloud. Making the verdict rule honest about both took more work than the happy path: both signals must agree, and disagreement defaults to Uncertain, never to a payment.
• Finding a real burned plot is harder than it sounds. We scanned a 260-field lattice around the demo area across the season window and found no persistent real burn scar to use as the burned fixture. Rather than fabricate a "real" detection, we mirrored plot 2's scar and FIRMS rows in the exact format of the real data and labelled them as mirrored everywhere they appear.
• Testnet plumbing. The original Polygon Amoy RPC hostname had been retired and no longer resolves, and our build environment's network held JSON-RPC writes. Deployment and the end-to-end replay ran from a machine with working RPC egress against a public endpoint, funded by a proof-of-work browser faucet, with every transaction recorded in the repo for replay.

Accomplishments we are proud of

• A complete, working chain, not a slide deck: contract deployed on Polygon Amoy, plot 1 registered, an oracle-signed NoBurn claim submitted, the attestation read back from chain state, and the duplicate registration shown reverting. Links are in the repo README and below.
• 33 automated tests green: 15 Hardhat tests covering every contract revert path plus a cross-language round trip where a Python-oracle signature is accepted by the compiled contract, and 18 pytest tests covering the oracle's verdict rule, hashing, and tamper detection (a one-field mutation flips /verify to invalid).
• A duplicate-claim defence that survives redrawing: because land is registered as H3 cells, shifting an outline by metres still overlaps and still reverts.
• Contract source verified two ways: Sourcify reports an exact match on the deployed bytecode, and the PolygonScan page shows "Source Code Verified" with the full source and decoded constructor.
• Provenance labels we would defend in person: every fixture in the demo says whether it is real or mirrored, and the UI shows the same labels the repo does.

What is next

• Live FIRMS ingestion once we hold a NASA MAP_KEY, replacing the mirrored plot 2 rows with live detections, plus scheduled Sentinel-2 pulls across a full season.
• A small accuracy study: run the pipeline over a set of hand-verified plots and publish the confusion matrix, including how often Uncertain is the honest answer.
• A post-quantum migration note for the signing scheme. ECDSA is not quantum-safe, and attestation evidence needs to stay trustworthy for years; the security note in the repo sketches the migration path.
• Pilot conversations with the two adopter profiles the tool is designed for: a state residue-management incentive desk and pollution-control enforcement teams, where the same tamper-evident trail serves both payment and penalty workflows.

Built With

• fastapi
• h3
• hardhat
• javascript
• leaflet.js
• nasa-firms
• openzeppelin
• polygon
• python
• sentinel-2
• solidity