AntiScalper Protocol
Sybil-resistant access to scarce physical drops: World ID gates the claim, Sui settles it.
Demo
About
AntiScalper Protocol (ASP) is an access-control and payment layer for physical machines, designed to prevent scalping on limited releases. Payment on its own proves that a transaction happened, not who made it or whether they already claimed. Scalpers exploit that gap by opening more wallets. Asp closes it by combining two primitives: - World ID (Proof of Human) binds each entitlement to a unique human through a zero-knowledge nullifier. - Sui handles settlement. Machines can be hired programmatically over x402, and at the point of sale the buyer pays through Sui Payment Kit (Slush). Claim flow: 1. Registration: the user verifies with World ID and receives a ticket bound to their nullifier. 2. Authorization: at the kiosk, the user re-verifies. The claim is authorized only if the nullifier matches the ticket holder and the proof is bound to that specific claim request. 3. Settlement: the kiosk issues a Payment Kit request as a Slush QR code. The gateway confirms the on-chain PaymentReceipt before continuing. 4. Fulfillment: the gateway sends a single dispense command over MQTT to an ESP32-controlled motor. Each entitlement can be redeemed exactly once. Replayed proofs, mismatched identities, and repeat claims are rejected before payment or dispense. Machines stay hireable over x402, but a PoH-gated release cannot be purchased without World verification. Live demo: https://altaga-asp.expo.app
How it's made
World ID integration: - IDKit 4.0 with Selfie Check. RP signatures are generated server-side, so the signing key never reaches the client. - Every proof is verified against World's /api/v4/verify endpoint. Authorization fails closed; client-side success callbacks are never trusted on their own. - The claim signal is set to the claim request ID, so each proof is bound to a single claim and cannot be replayed. - The gateway enforces a strict nullifier-to-ticket mapping: one human, one ticket, one redemption. Sui integration: - x402: POST /asp/hire returns an HTTP 402 challenge, built on @altaga/x402-sui exact-payment schemes with sponsored gas. Apps and agents can hire machine capabilities programmatically. - Payment Kit: the gateway builds Payment Kit transaction URIs (receiver, amount, USDC, nonce) and exposes them as Slush deep links. Settlement is confirmed by matching the PaymentReceipt event on-chain by nonce, amount, and receiver. - Both payment paths go through the same policy check (assertHireAllowed), so PoH-gated capabilities cannot be bought without prior World authorization.