Problem

Imagine you want to create a web2 website vitalikfeetpicsmonthly.com that provides quality content for a modest fee. Your users would be happy to pay, but they would not want to be tracked in any way, even correlating different login sessions.

fckuipaid.xyz is a website and a login flow that could be integrated into a website allowing you exactly that. Users pay monthly fee to a smart contract on Arbitrum and log in with a zk proof of payment, so web2 service knows that they paid.

How fckuipaid works

Flow

• User approves spending to the payment contract
• User calls pay(month) function on the payment contract that pulls the required fee and registers payment for a given month
• User uses Boundless Steel coprocessor to generate a proof of payment. For this user signs a Metamask message, the following is proved: signature is valid (i.e. user controls the privKey), hasPaid function returns true for the given month and user (checked against the current state root). The proof could be generated locally in theory (not in our impl)
• User copies the zk proof together with the public inputs (current block hash, month number) and pastes it to the website. The proof is verified against public inputs, on success user is logged in.

Components

• fckuipaid.xyz: Website that provides a convenient UI for paying the monthly fee for a chosen service and requests the backend to generate a valid proof of payment.
• Boundless: Boundless SDK is used on the backend to generate a zk proof of payment agains the current state root. We make a request to boundless prover market.
• vitalikfeetpics.com: web2 website that verifies the zk proof of payment. It also checks that the payment month from the public inputs is the current month.