The problem SilentLedger solves

SilentLedger transforms digital reputation into on-chain, privacy-preserving credentials using zero-knowledge proofs.

Key Uses:

1. Sybil-Resistant Rewards

• Prevent bots in airdrops, DAO voting, token claims
• Cost to attack: ~$50 per proof vs $0 previously
• No KYC required

2. Fast, Unbiased Hiring

• Replace resume parsing with AI-audited GitHub scores
• Verify skills objectively in minutes, not weeks
• Eliminate hiring bias (no names/photos shown)

3. Portable Reputation

• Build reputation once, use it everywhere
• SBTs (Soul-Bound Tokens) stay in your wallet forever
• No platform lock-in

4. Anonymous Credential Verification

• Prove you're a verified GitHub contributor without revealing username
• Show employment history without doxxing
• Verify education without exposing transcripts

5. Privacy-First Data Contribution

• Contribute to research/governance anonymously
• Prove eligibility criteria without revealing medical/financial data
• Comply with GDPR/HIPAA while participating

How It Improves Existing Tasks

┌──────────────────────┬────────────────────────────┬──────────────────────────────────────┐
│ Task │ Old Way │ SilentLedger │
├──────────────────────┼────────────────────────────┼──────────────────────────────────────┤
│ Airdrop distribution │ Easy to bot, 70% wasted │ Bot-proof, targeted │
├──────────────────────┼────────────────────────────┼──────────────────────────────────────┤
│ Hiring │ 4-6 weeks, subjective bias │ 24 hours, objective scores │
├──────────────────────┼────────────────────────────┼──────────────────────────────────────┤
│ DAO voting │ 1 person = 1000 votes │ 1 person = 1 vote (costly to attack) │
├──────────────────────┼────────────────────────────┼──────────────────────────────────────┤
│ Freelancer rep │ Locked to Upwork/Fiverr │ Portable across platforms │
├──────────────────────┼────────────────────────────┼──────────────────────────────────────┤
│ Whistleblowing │ High risk, low credibility │ Anonymous + provable access │
└──────────────────────┴────────────────────────────┴──────────────────────────────────────┘

Core Innovation

Prove you have credentials without showing them.

Traditional: "Sign in with X" → X gives all your data to the app.

SilentLedger: Generate cryptographic proof → app verifies → zero personal data shared.

Result: Trust without surveillance.

Challenges we ran into

Loading dashboard made 20+ eth_call requests (one per attestation + SBT), taking 8+ seconds.

Use of AI tools and agents

AI Integration in SilentLedger

🤖 How AI Tools Are Used

1. Google Gemini - Code Quality Auditor

The AI component analyzes GitHub repositories to generate an objective quality score.

// Frontend triggers audit
POST /api/github-audit
{
"username": "developer123",
"address": "0x..."
}

What Gemini analyzes:

• Code structure : Module organization, separation of concerns
• Testing coverage : Test files, test pass rate (via GitHub Actions)
• Documentation : README quality, inline comments
• Best practices : No security anti-patterns, proper error handling
• Consistency : Code style conformity (via linting configs)
• Community metrics : Stars, forks, contribution frequency (weighted lightly)

Output:
{
"score": 87,
"summary": "Well-structured codebase with comprehensive tests...",
"totalStars": 2450,
"signatureData": { /* oracle signature */ }
}

🔗 How AI Works with the Rest of the System

┌─────────────────┐
│ User Dashboard│
│ (Next.js) │
└────────┬────────┘
│ clicks "AI Audit"
▼
┌─────────────────┐
│ Frontend │ validates: user has GitHub proof
│ (page.tsx) │ (via zkTLS already on-chain)
└────────┬────────┘
│ POST /api/github-audit
▼
┌─────────────────┐
│ API Route │ fetches GitHub repos
│ github-audit │ via GitHub REST API
│ (Next.js) │ (Octokit library)
└────────┬────────┘
│ calls Gemini
▼
┌─────────────────┐
│ Gemini API │ analyzes code patterns,
│ (Google) │ generates score 0-100
└────────┬────────┘
│ receives score
▼
┌─────────────────┐
│ Oracle Signer│ (backend, not exposed)
│ (server) │ creates signature:
│ │ sign(keccak256(score+user+deadline))
└────────┬────────┘
│ returns signed result
▼
┌─────────────────┐
│ Frontend │ displays score
│ receives: │ user clicks "Save to Wallet"
│ score + sig │
└────────┬────────┘
│ submitOracleProof(signature, data)
▼
┌─────────────────┐
│ SilentLedger │ contract verifies:
│ Attester.sol │ 1. Signature from oracle address
│ │ 2. Score within range (0-100)
│ │ 3. Not expired (deadline check)
└────────┬────────┘
│ emits AttestationWithOracle
▼
┌─────────────────┐
│ EAS │ attestation stored on-chain
│ (Sepolia) │
└────────┬────────┘
│ event emitted
▼
┌─────────────────┐
│ SBT Minter │ if AI audit → mint CertificationSBT
│ (auto) │ soul-bound token
└─────────────────┘

🔐 Security & Validation Layers

Layer 1: GitHub Ownership

Before allowing AI audit, user must:

1. Have wallet connected
2. Have GitHub account already verified via zkTLS (in "Legitimacy" tab)
3. The verifiedUsername state is set only after successful Reclaim proof

// Dashboard prevents audit without prior verification
if (!verifiedUsername) {
return showWarning("Verify GitHub first via zkTLS");
}

Why? Prevents fake audit requests for "microsoft" or "facebook".

Layer 2: Server-Side Rate Limiting

API route enforces:
// github-audit/route.ts
const rateLimit = await ratelimit.limit(5, "DAY"); // 5 audits/day per IP

Layer 3: Oracle Signature

The signed payload includes:
const payload = {
recipient: userWallet, // Must match attester
competenceName: "Open Source Contributor",
level: 1, // Not currently used
examScore: score, // 0-100 from Gemini
proofOfWorkURL: https://github.com/${username}, // Verifiable source
studentId: keccak256(wallet), // Unique ID
deadline: Math.floor(Date.now() / 1000) + 3600 // 1 hour expiry
};

Oracle private key signs. Contract has address public oracleSigner. Only that address's signatures accepted.

Layer 4: On-Chain Validation

SilentLedgerAttester.submitOracleProof() checks:
function submitOrac