The problem SECUREID solves

The Problem We Solve
Traditional KYC or human verification services (like Persona, Jumio, or Stripe Identity) require users to upload passport photos and biometrics to centralized databases. This model presents critical flaws:

Centralized Data Leaks: Storing database copies of passports, driver's licenses, and biometrics creates high-value targets for hackers, leading to massive identity leaks.
Lack of User Ownership: Users lose control of their personal information the moment they upload it to a server.
Linkability & Sybil Attacks: Web3 applications need a way to verify unique humans (Sybil resistance) without linking their real-world identities across different dApps.
User Friction: Having to go through full document uploads for every individual website is repetitive and slow.
The SECUREID Solution
SECUREID introduces a Zero-Storage SSO Gateway that verifies identity parameters entirely on the client-side:

Zero Raw Data Storage: Biometrics and government ID scans are captured, cropped, and immediately hashed locally using Keccak256 inside the browser canvas. The raw files are wiped from memory and never uploaded.
On-Chain Soulbound Identity Passes (SBTs): Verifying the local hash creates an on-chain registry of unique nullifiers. Successful checks mint a non-transferable SBT representing a verified identity to the user's wallet.
Private Age Gating (zk-SNARKs): The user generates a ZK proof proving their birth year meets age criteria (e.g. Age $\ge$ 18) without disclosing their exact date of birth or name.
🛠️ The Tech Stack
Smart Contracts & Blockchain: Solidity (v0.8.24), Hardhat, and OpenZeppelin ERC721.
Zero-Knowledge Circuit: Circom (for ZK arithmetic constraints) and SnarkJS (Groth16 proving in the browser).
Frontend SSO Engine: Vite, React, Lucide-React, and Tailwind/Vanilla CSS.
Web3 Integration: Ethers.js (v6) for MetaMask connection and Sepolia testnet transaction pipelines.
⚙️ How It Works (Step-by-Step)
Decoupled Redirect: A gated portal (e.g. PulseTV Premium) requires verification and redirects the user to the SECUREID gateway.
Local Camera Scanning: The user takes a Face Liveness scan (in a circle crop) and an Aadhar ID card scan.
Canvas Hashing: The webcam frames are processed inside an HTML5 <canvas> and hashed locally. The raw biometrics are destroyed in memory.
ZKP Witness Generation: The browser generates a ZK-SNARK proof verifying that:
The user possesses a credential signed by an authorized issuer public key.
The age calculated from the credential timestamp satisfies the condition.
A unique nullifier hash is computed to block double-KYC attacks.
On-Chain Validation: The ZK proof is verified by the IdentityRegistry.sol contract on Sepolia, minting an SBT to the user's wallet.
Decryption & Access: The callback unlocks access to the calling dApp, unblurring the premium interface.

Challenges I ran into

Challenges Faced

The biggest challenge was implementing privacy-preserving verification within a limited development timeframe while understanding and integrating unfamiliar blockchain and cryptographic concepts. We had to work through the interaction between zero-knowledge proofs, Ethereum smart contracts, wallet authentication, and frontend verification.

Another challenge was ensuring that sensitive identity information was never unnecessarily exposed or stored on-chain, while still making the verification process simple enough for users to understand and use.

We also faced challenges with Ethereum Sepolia testnet transactions, wallet connectivity, smart-contract integration, and debugging cryptographic verification flows**.

Working under the hackathon time constraint required us to prioritize the core privacy and verification functionality and build a working proof-of-concept rather than attempting to implement every feature at production scale.