The problem SuiSure solves

Safer and simpler on-chain merchant payments

QR payments are already familiar to Malaysian users through systems such as DuitNow, TNG and Grab. However, a displayed merchant QR can potentially be covered, replaced or manipulated, causing the customer to pay a different recipient without immediately realizing it.

On-chain payments introduce an additional challenge: transactions are irreversible, wallet addresses are difficult for ordinary users to recognize, and making a normal transfer often requires manually copying an address, selecting the correct token and entering the amount.

SuiSure brings the convenience of QR payments to on-chain merchant transactions while introducing two layers of verification:

1. Before signing, SuiSure retrieves and cross-checks the merchant credential and payment request from Sui. It verifies the merchant, amount, token, expiry and whether the request has already been paid.
2. During execution, the Move contract enforces the checks again and retrieves the payout address from the registered merchant credential; not directly from the QR code.

This means a QR code cannot simply provide or replace the trusted destination address.

Customers can scan a QR, upload a QR image or describe the intended payment using AI assistance. The AI interprets the request, helps calculate and explain its risk score, and presents the result in understandable language. However, it cannot select the trusted recipient, change verified values, sign or approve the transaction.

For merchants, SuiSure provides structured payment requests, QR generation, payment-status tracking and incoming-payment visibility. For customers, it makes paying with stablecoins more familiar, understandable and safer than manually transferring funds to a hexadecimal wallet address.

SuiSure is inspired by the convenience of DuitNow QR, strengthened by on-chain security.

Payment Review Section

Confirmed Payment in Merchant Account

SuiSure AI Interpretation Results

Challenges we ran into

Aida: Sui Smart Contracts and Payment Infrastructure

A late security review revealed that Payment Kit checked a coin’s value but not its type, potentially allowing a USDC request to be paid with another token. Fixing this required republishing the Move package and recreating all Testnet data. Differences between the documentation and source code also required direct dependency inspection and custom payment receipts.

Aidan: AI Safety and On-Chain Merchant Resolution

The main challenge was connecting natural-language instructions to genuine merchant-issued payment requests without allowing the AI to create or manipulate payments. The final design restricts AI to interpretation, while merchant resolution, amount matching and prompt-injection protection are handled deterministically using verified on-chain data.

Syafieqah: Frontend, Authentication & End-to-End Integration

The frontend needed to support both Google zkLogin and external Sui wallets through one consistent payment flow. End-to-end testing uncovered issues involving production configuration, balance detection, authentication redirects, responsive dialogs and account activity isolation. These were resolved while preserving user approval and on-chain verification.

Overall

The largest lesson was that successful compilation was not sufficient evidence that the system was safe or ready. Documentation, model output, generated configuration and cached Testnet assumptions could all be incomplete or misleading. We therefore relied on source inspection, deterministic validation, on-chain verification, automated health checks and repeated end-to-end testing across both wallet and zkLogin users.