The problem PharmaTrust solves

Counterfeit and diverted pharmaceuticals are hard to catch with paper records or private databases. A paper trail can be forged, and a database can be silently edited by whoever controls it. Neither gives a patient, pharmacist, or regulator a way to independently verify a specific package's history before use.

PharmaTrust puts the entire custody chain on Sui instead, so it's public, tamper-evident, and permanently attributed to whoever signed each step. Manufacturers register a batch on-chain, optionally backing it with staked SUI as collateral, and print QR codes straight onto packaging. Distributors and pharmacies record every hand-off as a checkpoint, including cold-chain temperature readings, permanently tied to their wallet with no way to forge who touched it. Anyone can scan a package, with no wallet needed, and instantly see its full custody history, run an independent AI cross-check across two different models for tampering or timing anomalies, and check a public recall registry before dispensing or buying. Regulators or pharmacy staff can place a hold the moment something looks wrong, and it immediately blocks further sales and checkpoints rather than just flagging paperwork, with graduated financial penalties in the form of slashed stake scaled to how serious the finding is. Customers pay for medicine with a single-use QR plus a scratch code that's physically deleted from the blockchain the instant it's redeemed, so the same package can never be sold twice off one photo of the QR.

In short, it turns "trust me, this is genuine" into "verify it yourself, for free, in seconds."

Challenges we ran into

A stale environment variable silently broke every write transaction in production. After adding staking, suspicion reports, and single-use sale QRs to the Move contract, we discovered VITE_PACKAGE_ID on our Vercel deployment still pointed at a much older contract version published before any of those features existed, one that even gated place_hold behind a RegulatorCap we'd since removed. Every write transaction was failing with argument-count mismatches while every read still worked, which is exactly why it went unnoticed: the site looked fine until you tried to actually submit something. We caught it by disassembling the deployed package bytecode directly and diffing its function signatures against our current contract, which taught us never to trust "the site loads" as proof a deployment is actually current.

A hosted AI model silently substituted itself for another. Our two-model AI cross-check depends on genuinely independent verdicts, but we found that requests to one model, Kimi-K2.6, were being silently served by a completely different model on the router's side, with no error and no indication in the response, which defeated the whole point of cross-checking two models. We fixed it by adding an X-Gonka-No-Fallback header, which turned the silent substitution into an honest error revealing the model had zero capacity, and swapped in a model we verified was genuinely distinct.

Sui's public JSON-RPC endpoints deprecated the API our wallet-kit version depends on partway through the project, returning "Method not found" with no CORS headers, which broke every browser call outright. We solved it by pointing at a CORS-enabled public RPC provider instead of Mysten's own endpoint.

Move package upgrades quietly break event-based indexing. A minor contract change that only tightened a validation check, with no struct changes, looked like a safe sui client upgrade instead of a fresh publish, until we discovered every event's package ID switches to the new address after an upgrade, silently orphaning every dashboard that filters events by a fixed package ID. We now always publish fresh rather than upgrade, trading batch and unit continuity for a single reliable source of truth in the event log.