FormDrop

Demo

About

**FormDrop turns any Google Form into a crypto payout machine — respondents get paid instantly, in testnet HBAR/USDC, just for filling out a form, with zero wallet setup required.** **The problem:** - **Crypto payment products can never reach the people who'd actually benefit most.** Every crypto-payments idea shares the same failure mode: it asks people to adopt a new app or platform first, and almost nobody does. Meanwhile Google Forms already has 700M+ monthly users — researchers, professors, community managers, growth teams — running exactly the kind of paid surveys and bounty campaigns crypto rails are supposedly perfect for. That audience has been completely unreachable, because nothing meets them inside the tool they already use. - **Instant payout with no verification is a fraud vector, not a feature.** Pay the moment someone submits and you're paying bots, copy-pasted spam, and gibberish right alongside real answers. - **No fraud resistance means one person can drain the whole pot.** Even with quality checks, the same human can resubmit under a dozen fake emails and claim the reward every time. - **"Get a wallet first" kills the reward before it starts.** Asking a stranger to set up a wallet and safeguard a seed phrase — before they even know if the reward is worth it — is a dead end for anyone but existing crypto users. - **Card rails can't do this economically.** Network fees eat a $0.10 payout alive, and cross-border payouts take days through traditional banking rails. **How FormDrop solves every one of these, together:** - **It ships inside Google Forms itself — zero new distribution cost.** A creator connects a form they already made, in the tool they already use. There's no new platform to convince anyone to adopt. - **An AI judge replaces manual review.** Every response is read by Google Gemini against the creator's own rubric the instant it's submitted, approving genuine answers and auto-rejecting spam or gibberish. - **World ID shuts down farming.** Claiming requires a ten-second Selfie Check — one real human, one payout, per form, enforced by a real database constraint. - **Privy makes the wallet invisible.** A wallet is silently provisioned by email the moment a response is approved — no seed phrase, no wallet UI, nothing that looks or feels like "crypto." - **Hedera makes it fast, cheap, and auditable.** Payouts settle in seconds for a fraction of a cent, every AI verdict is anchored to Hedera Consensus Service as a public record, and an on-chain escrow contract — not just our backend — guarantees no response is ever paid twice.  **The bigger unlock: this is a real crypto onboarding funnel, not just a payments feature.** Every respondent who gets paid now owns a real, self-custodial wallet holding real funds on Hedera — the actual first crypto transaction of their life, for most of them — without ever making a conscious decision to "get into crypto." They just filled out a form, the way they always have. At Google Forms' scale, that's not a niche crypto product finding a few early adopters; it's mainstream people transacting in crypto for the first time, by accident, because the form they were already filling out happened to pay them. That's a distribution and adoption channel nothing else in the space has access to.

How it's made

Stack. A pnpm/TypeScript monorepo: apps/web (Next.js 15) for the creator console and respondent claim page; services/orchestrator and services/resource-server (Fastify) as two deliberately separate backend services; Postgres (Supabase) for form/response/verdict state; a Solidity escrow contract on Hedera's Smart Contract Service. The two backend services are the literal shape of an x402 payment: orchestrator is the paying client, resource-server is the gated service it pays — /verify returns HTTP 402 until orchestrator actually settles. The hack we're proudest of. Privy has no native Hedera chain type — only ethereum, solana, etc. But Hedera runs on the same secp256k1 curve, and HIP-583 auto-creates an account from an EVM address the first time it receives funds. So we provision plain Privy ethereum wallets and use their address directly as a Hedera payout destination — no bridging. Confirmed on Hedera's Mirror Node: the account shows up exactly as HIP-583 predicts, a "hollow" account with no key set. Payments and audit trail. The AI-judgment call is paid via x402, settled in testnet USDC (an HTS token) through the Blocky402 facilitator. Every verdict — approve/reject, a SHA-256 hash of the response (keeps respondent text off a public ledger), and the paying transaction id — is anchored to a Hedera Consensus Service topic with no admin key, so anyone can independently audit it via the Mirror Node. On-chain escrow, and two real bugs. FormDropEscrow.sol enforces on-chain that a response can never be paid twice and a form can never pay out more than it was funded. Shipping it surfaced two Hedera quirks: an ECDSA account's msg.sender inside the EVM is its real alias address, not the "long-zero" form most tooling shows (the contract needed redeploying against the right one); and HIP-583's hollow-account auto-creation doesn't fire for a contract's internal .call{value}(...) the way it does for a top-level transfer, fixed with a 1-tinybar "pre-warming" transfer before every payout. Identity and wallets. World ID's Selfie Check gates every claim, scoped per-form via a nullifier, so one human can't drain a pot under multiple emails. Respondent wallets are Privy-provisioned by email and locked with a policy denying every wallet method (receive-only by default); the creator's funding wallet is owned by a Privy key quorum, not a single key. The unglamorous bug. Claim emails worked locally, then failed in production — Render blocks outbound SMTP ports on free tiers. A backup HTTP email provider got flagged for fraud review before it sent a single message. Fixed by switching to the Gmail REST API over plain HTTPS, authenticated via OAuth2 against an account we already trust.