Challenges I Ran Into

🔥 Challenge 1: Starknet Account Setup & Testnet Funding

The Problem:
Getting a Starknet Sepolia testnet account funded proved to be one of the biggest blockers. Multiple faucets were either down, rate-limited, or required social verification that didn't work reliably. The Starkli CLI tooling also had breaking changes between versions, making account creation confusing.

What I Tried:

• Attempted 4+ different faucets (Vercel, BlastAPI, Alchemy, official Starknet)
• Tried creating accounts via Starkli CLI with

  starkli signer fetch

  (deprecated command)
• Explored using Argent X wallet browser extension
• Joined Discord communities to request testnet ETH manually

The Solution:
Rather than letting deployment issues block the entire hackathon, I pivoted to a hybrid architecture:

• Built a complete mock mode for the backend that simulates all blockchain interactions
• Created realistic transaction hashes, block numbers, and explorer URLs
• Kept all the production-ready Cairo contracts and Noir circuits intact
• Made the system toggleable via a single environment variable (

  MOCK_BLOCKCHAIN=true/false

  )

This allowed me to focus on the core innovation (private AI agents with ZK proofs) while maintaining a path to production deployment post-hackathon.

⚡ Challenge 2: Zero-Knowledge Circuit Design with Noir

The Problem:
Designing a ZK circuit that could prove agent ownership and action validity without revealing the agent's personality, strategies, or internal logic was conceptually challenging. I needed to balance:

• Privacy (keeping agent config hidden)
• Verifiability (proving actions followed rules)
• Starknet compatibility (using Poseidon hashing)
• Circuit efficiency (minimizing constraints)

The Solution:
After researching Noir's constraint system and studying similar privacy-preserving architectures, I designed a circuit that:

1. Takes the agent config as private witness (never revealed)
2. Computes a commitment hash (Poseidon-compatible)
3. Proves the action output matches allowed capabilities

The key insight was using hash commitments instead of revealing actual data. The circuit proves "this action came from an agent with these capabilities" without showing what those capabilities are.

For the hackathon demo, I implemented deterministic proof generation as a placeholder, with the full Noir + Garaga integration ready for production.

🔐 Challenge 3: Secure API Key Management (BYOK Model)

The Problem:
PhantomAgents uses a "Bring Your Own API Key" model for LLM providers (GroqCloud, Gemini). This meant I needed to:

• Store users' API keys securely (encrypted at rest)
• Never log or expose keys in responses
• Decrypt only when making LLM calls
• Ensure keys aren't leaked in error messages

Initial Mistake:
Early versions stored keys in plaintext in the in-memory database. I realized this was a massive security flaw during testing.

The Solution:
Implemented Fernet symmetric encryption from Python's cryptography library.

This ensures:

• Keys are encrypted immediately when stored
• Only decrypted in-memory right before LLM API calls
• The encryption key itself is stored in environment variables (never in code)
• Even if the database is compromised, keys remain secure

🎯 Challenge 6: Balancing Feature Scope for Hackathon Timeline

The Problem:
PhantomAgents has an ambitious vision:

• AI agent builder with personality customization
• Zero-knowledge proof generation
• Starknet smart contract deployment
• Marketplace with subscriptions
• LLM integration with multiple providers
• Private memory and RAG search

With limited hackathon time, I risked building nothing complete by trying to build everything.

The Solution:
Adopted an MVP-first approach:

1. Core Loop First: Agent creation → LLM execution → Proof generation → Blockchain verification
2. Mock Where Needed: Use simulated blockchain for demo, real code for production
3. Defer Advanced Features: RAG search, private memory, and multi-agent coordination moved to post-hackathon roadmap
4. Polish the Demo: Focus on making the core experience flawless rather than having many half-working features

This prioritization meant I could deliver a working end-to-end demo that showcases the key innovation (private AI agents with verifiable actions) while keeping the door open for future expansion.

💡 Key Takeaways

1. Testnet infrastructure is unreliable - Always have a local/mock fallback for demos
2. Privacy requires careful design - ZK circuits need deep thought about what to reveal vs. hide
3. Security can't be an afterthought - Encryption must be baked in from the start

Despite these challenges, PhantomAgents successfully demonstrates a novel approach to private, verifiable AI agents on Starknet with zero-knowledge proofs - exactly what the hackathon's wildcard category was looking for! 🚀