Votify

Inspiration

Only about half of Americans trust their elections. In 2026, just 49% said they were confident in the honesty of US elections (Gallup). Before the 2024 presidential election, only 47% were confident the votes would be counted accurately (AP-NORC).

That trust also swings widely from one election to the next. After 2020, 59% of voters said elections across the country were run well. After 2024, 88% did (Pew Research Center).

People trust what they can see. After the 2024 election, 67% of Americans were confident in their local election officials, but only 57% were confident in the national count (AP-NORC).

All of this comes from one design flaw: voters are asked to trust the count, because they have no way to check it themselves. The obvious fix, publishing every vote, would end the secret ballot.

With the widespread misinformation about election results voters are left frustrated and confused on the integrity of their vote. They need a way to verify the results them selves.

This problem made us ask our selves: How can we…..

Background

Every US passport book issued since 2007 has a unique NFC chip. This chip acts to digitally identify you by holding a digital signature of your passport data issued by the us government. Most people carry a government-signed digital ID and never use it.

Zero-knowledge proofs uses mathematical equations to prove a statement is true without revealing the evidence behind it. For example, you can prove "I am an adult US citizen with a valid passport" without revealing your name, birth date or passport number. Every zero-knowledge proof has three properties:

Completeness: if the statement is true, an honest prover can always convince the verifier. Every eligible voter with a valid passport can register.
Soundness: if the statement is false, no one can produce a proof that passes, except with negligible probability. A forged or tampered passport, an underage voter or a non-citizen cannot register.
Zero knowledge: the verifier learns nothing except that the statement is true. Solana learns that an eligible voter registered, but not who they are.

Problem

The future of our election systems needs to be:

Verifiable: anyone can check the result for themselves.
Private: no one, including the people running the election, can learn how you voted.
Secure: only eligible citizens vote, and each votes once.

Today's systems usually give up one of the three. Publishing everything would make elections verifiable but end the secret ballot. Anonymous online polls are private but can't stop fake or repeat voters.

Votify

Votify is a privacy-preserving, publicly verifiable voting system built on Solana, using secure digital IDs and zero-knowledge proofs.

Scan. Scan your passport's photo page and tap the passport to your iPhone. The app reads the chip and checks the government signature. It then builds a zero-knowledge proof that you are an adult US citizen with an unexpired passport, and registers an anonymous voting credential on Solana. Your passport data never leaves your phone.
Vote. Show your voting QR code at a kiosk and pick a candidate. The kiosk builds a second proof showing you're a registered voter, without revealing which one, and submits your vote.
Verify. A Solana program checks every proof, blocks double registration and double voting, and keeps a public tally. Anyone can watch the live results and re-check every transaction.

Nothing on chain links a vote to a registration or to a person.

How we built it

Circuits: two Circom circuits, proved with Groth16 on the BN254 curve. The registration circuit (432,830 constraints) re-checks the passport's full signature chain inside the proof: three SHA-256 hashes and an RSA-2048 signature check. It also checks nationality, age and expiry. We wrote our own RSA, variable-length SHA-256 and byte-selection gadgets for it.
Solana program: written with Anchor, including our own Groth16 verifier built on Solana's alt_bn128 elliptic-curve syscalls. Registered voters are stored in an on-chain Poseidon Merkle tree.
iPhone app: SwiftUI and CoreNFC. It reads the photo page with Vision, reads the chip over NFC, and verifies the passport's signature on the device.
Relayer: a Node service that pays transaction fees, so voters never need a wallet and no wallet address is linked to a vote.
Kiosk and results: a React web app. The kiosk scans QR codes and builds the vote proof in the browser. The results page reads live from Solana and shows the tally, turnout and every transaction, including rejected double votes.

Solana

We built our project on Solana which we decided was the only blockchain that could support this project.

Because of Solana's almost instantaneous transaction speed we are able to support tens of thousands of voters at once on the network with minimal latency. and confirm votes in seconds, so the public ledger updates live.

Solana also provides us with extremely low transaction fees allowing our system to cost less than the current system Solana is what makes on-chain zero-knowledge verification practical: Solana also has a built int PDA feature which we use for our security of our vote so where someone tries to vote again and their ID is published to the Solana block chain there is a PDA collision that occurs letting the system know that this account has already made their votes.

Our Solana program is deployed to the Solana Devote at this address if you would like to view it:

Challenges we ran into

The passport's signature chain. The government signature doesn't cover your data directly. It signs a hash of a list of hashes, so the circuit has to rebuild that whole chain exactly as the chip stores it, byte for byte.
RSA inside a zero-knowledge circuit. Verifying a 2048-bit RSA signature means 17 multiplications of numbers far larger than the circuit's native field. We split them into 121-bit limbs and checked every carry.
A subtle attack. While testing, we found that a prover could hide the hash of a fake passport in unused padding bytes and point the circuit at it. We added a constraint that closes this gap, plus a test that tries the attack.
Matching three languages. The same Merkle tree and hashes had to give identical results in Rust, TypeScript and Swift, so we built shared test vectors to check all three.
Setup time. Generating the proving keys for a circuit this size took about an hour on a laptop.

Accomplishments that we're proud of

We read and verified a real US passport chip on an iPhone, without storing or sending any personal data.
A full registration proof takes 5.7 seconds on a laptop, and Solana verifies it on chain.
We ran a complete election end to end: registration, kiosk voting, a live public tally, and double votes rejected on chain.
We wrote our own Groth16 verifier and RSA/SHA-256 circuit gadgets, covered by 88 automated tests, including tests that try to forge signatures and plant fake data.
An automated privacy test confirms that no passport field appears in any transaction.

What we learned

How passports actually prove they're genuine, and how to turn that proof into a zero-knowledge statement.
How to design circuits where every constraint matters: one missing check can let someone forge a registration.
How Solana's syscalls make proof verification affordable on chain.
That "verifiable" and "private" aren't opposites. With zero-knowledge proofs, you can have both.

What's next for Votify

Every voter, not just passport holders: We'll accept any government-signed ID, including mobile driver's licenses in Apple and Google Wallet.
Built for the world: Votify runs on the same chip standard as passports worldwide, so we'll expand to elections across the globe, starting with citizens abroad who currently have to travel to an embassy to vote.