TIDEMARK — Physics-Checked Disaster Evidence

Inspiration

Every major climate disaster now comes with a second disaster: fake evidence. During the August 2026 Nepal floods, Hurricane Melissa (2025) and Hurricane Helene (2024), AI-generated and recycled images went viral within hours, drowning out safety information and confusing responders.

At the same time, the UN Fund for Responding to Loss and Damage is under pressure heading into COP31 (Antalya, Nov 2026) to move money to affected communities quickly and transparently. But funders, NGOs and insurers have no fast, trusted way to know which ground-level damage photos are real.

Existing tools each do one piece: hash photos onto a blockchain, or run an AI-image detector. We noticed nobody asks the most obvious question a meteorologist would ask:

Was it actually raining 200 mm here in the 72 hours before this photo was taken?

Climate data already knows the answer. We wanted to make it a witness.

What it does

TIDEMARK is a physics-checked disaster evidence ledger.

1. Capture: a citizen, volunteer or local official uploads a photo with location, time and hazard (flood, storm, landslide, wildfire, heat, drought). EXIF GPS and time pre-fill the form.
2. Verify: four independent checks produce a Tidemark Score from 0 to 100:

$$ \text{Score} = \min\Big(\textstyle\sum_i w_i\, s_i,\ 40 \text{ if any hard fail}\Big), \quad w = (20, 30, 35, 15),\ s_i \in [0,1] $$

A recycled image, a GPS fix 300 km away, or a "flood" with no recorded rain is a hard fail that caps the score at 40, so a beautiful photo can't buy its way to "verified".

1. Anchor: only the hash, score, a ~5 km geohash, hazard code and timestamp go on-chain (Base Sepolia). Never the photo, never the exact location, never personal data. The contract rejects a hash that's already anchored, so the same evidence can't back two funding claims.
2. Atlas: a public map of evidence, clustered by disaster event and coloured by score.
3. Loss & Damage Dossier: for any event, a printable report with verified evidence by hazard and area, the physical conditions behind it, the score distribution and proof links, plus a JSON download for a fund's own systems.
4. Rumour Check: drop in a viral image and TIDEMARK tells you whether it matches verified evidence, matches an older record (recycled), or fails the physics check. You get a shareable result page to reply to the rumour with.

It shows its work. Every verdict comes with the evidence behind it: the 72 h rainfall, gust, temperature and humidity chart up to the claimed time, the EXIF table, the nearest perceptual matches and the ledger entry.

How we built it

• Next.js 16 (App Router) + TypeScript + Tailwind CSS v4, deployed on Vercel. The submit flow streams progress as newline-delimited JSON, so each check lights up as it completes.
• Each check is a pure module (integrity, recycling, physics, synthetic) with no I/O, which made the rules easy to unit-test. 54 Vitest tests cover scoring, every physics rule, dHash distance, rumour verdicts and ledger tamper detection.
• Open-Meteo for weather: the ERA5 reanalysis archive for claims older than 6 days, and forecast-model past_days history for recent ones. No API key needed.
• sharp re-encodes every image (stripping all EXIF/GPS from the public copy) and computes the dHash; exifr reads metadata.
• Claude vision via @anthropic-ai/sdk with structured outputs: the model must answer in a strict JSON schema, and its output is length-capped and rendered only as plain text.
• Solidity EvidenceRegistry on Base Sepolia with Hardhat 3 and viem: anchor() with duplicate rejection, plus anchorBatch() + verifyInBatch() for Merkle-root batching as the scaling path. 8 contract tests.
• Supabase (Postgres + Storage) with Row Level Security on and no public policies: only the server can read or write.
• react-leaflet + OpenStreetMap with our own zoom-based geohash clustering.
• Zero-key demo mode: every external module falls back to a clearly labelled demo version (in-memory seeded ledger, "demo analysis", hash-chained "simulated anchor"), and a banner shows which modules are live. Open-Meteo always runs for real.

The 25 demo records use placeholder art, never real disaster photos of real people, but the weather behind them is real: we placed them at the dates and places of late-Sept 2024 Kathmandu flooding (270–320 mm of rain in 72 h), Hurricane Melissa's Jamaica landfall (gusts up to 200 km/h), and the Nov 2024 Kelantan monsoon floods. Every score is computed by the production check modules. Three are deliberately bad, so the demo shows every outcome: a recycled image, a "wildfire" during 230 mm of monsoon rain, and an image full of generation artefacts.

Challenges we ran into

• Writing physics rules that are fair, not naive. A clear sky over a flooded street looks suspicious, but floodwater peaks hours to days after rain stops, so that combination is consistent, not a contradiction. Landslides can be seismic, so a dry window only warns. Droughts can't be confirmed from 72 hours at all, only contradicted.
• Our own placeholder images fooled our recycling check. Shared banners and horizons put unrelated demo images within 16 bits of each other. We had to vary the generated compositions until only the intentionally recycled pair matched (5/64 bits).
• Serverless body limits vs. EXIF. Vercel caps requests at 4.5 MB, but compressing a phone photo in the browser destroys its EXIF. So the browser reads EXIF on the device first and sends it alongside. The server uses it only if the file has none, and labels it "read on device".
• Stateless demo mode. In-memory data on serverless can land on a different instance on the next request, so the browser keeps the result it just received and the report page falls back to it.
• Brand-new tooling. Next.js 16 and Hardhat 3 both changed APIs and project structure, so we worked from their bundled docs rather than memory.

Accomplishments that we're proud of

• A verification signal that's physically grounded and explainable: judges, journalists or fund officers can see the exact rainfall and wind data behind each verdict.
• A privacy-first design: exact coordinates are used for the checks and then thrown away; only ~5 km cells are published.
• A meaningful use of blockchain: one hash, one claim, a guarantee that other funders can verify without trusting us.
• A real threat model (forged EXIF, recycled images, AI generation, sybil submitters, prompt injection via text in images), with each threat mitigated or flagged.
• It works on a phone, in dark mode, prints as a clean dossier, and deploys with zero configuration.

What we learned

• Reanalysis climate data is an underused trust tool: it's free, global, hourly, and independent of whoever took the photo.
• AI-image detection should be a signal for humans, not a verdict. Combining several independent, weak signals is far more robust than any one strong-sounding detector.
• Gridded data (~9–25 km) smooths local extremes like cloudbursts, so thresholds need to be conservative and every output needs to say what it can't know.

What's next for TIDEMARK

• Pilot with a local responder network and an NGO preparing a Loss & Damage funding request.
• Longer climate windows for slow-onset hazards (90-day rainfall anomalies for drought) and river-discharge data for upstream-driven floods.
• Merkle-batched anchoring through a verified relay, and BK-tree perceptual search for millions of images.
• C2PA content-credential checks, face blurring, and offline-first capture for areas with poor connectivity.
• A dossier schema co-designed with funders and parametric insurers.

Built With

• anthropic-claude
• base
• ethereum
• hardhat
• leaflet.js
• node.js
• open-meteo
• openstreetmap
• postgresql
• react
• sharp
• solidity
• supabase
• tailwindcss
• viem
• vitest