The problem TrustMesh solves

The Problem TrustMesh Solves

Digitalization is no longer optional for small and medium-sized enterprises (SMEs), yet many are trapped in a standoff that prevents them from taking the necessary risks. On the other side of this gap are Malaysian university students—a massive pool of emerging digital talent. This talent goes unused in the real economy because students must take non-relevant part-time work, like retail or barista jobs, just to survive their studies.

Both sides are paralyzed by a mutual lack of trust.

The SMEs' problem is risk. They know they need to digitize to scale, but they cannot afford the high costs of agency development. They want to hire students, but they will not send money up front. They have no cheap way to judge quality before paying, and they fear receiving incomplete work from a student they have never met.

The students' problem is opportunity. They need relevant professional experience to launch their careers, but they are terrified of being exploited. A student who builds a website for an SME and gets ghosted has no realistic recourse. Chasing a few hundred ringgit through formal channels costs more than the job is worth. Furthermore, they have no credible way to prove their skills—screenshots and promises don't win the next client.

So the SME remains stagnant, and the student's potential is wasted.

TrustMesh removes the standoff by removing the need for trust. We bridge the opportunity gap by replacing blind faith with a decentralized, automated protocol.

How TrustMesh Unlocks the Standoff

1. Fund and Prove. TrustMesh connects to the SME’s existing project management tools to automate job creation. The budget is locked into an escrow vault on the Sui blockchain in the same action. This funds the contract and proves to the student that the money is genuinely secured before they write a single line of code[cite: 1].
2. Submit and Audit. The student submits their completed work (links, summaries). TrustMesh leverages Gonka Router, a decentralized AI inference protocol, to act as an independent, impartial auditor[cite: 1]. Gonka compares the delivery against the original brief and scores it[cite: 1].
3. Automatic Payout. TrustMesh removes human bias and delays. If the AI review scores the work at 80/100 or higher, the escrow contract triggers an automatic payout in a single transaction: 90% to the student and 10% to the platform.
4. Verifiable Portfolios. The part students lack today is evidence. Every completed job on TrustMesh emits a MilestoneAuditedEvent on-chain. This permanent, public, and independent blockchain record carries the AI review ID, the score, and the amounts paid. It is the undeniable portfolio proof students need to show they have delivered in real-world scenarios.

Invisible Web3: Built for Everyday Businesses

Small business owners do not want to manage crypto wallets, memorize 12-word seed phrases, or buy volatile tokens. TrustMesh delivers the security of blockchain without the friction:

• 1-Click Google Sign-In: Both SMEs and students onboard in seconds using their standard Google accounts via Sui zkLogin[cite: 1]. No wallet extensions or private key management required[cite: 1].
• Zero Gas Fees: A backend relayer covers all network transactions through sponsored executions[cite: 1]. Users only see their digital dollar balance[cite: 1].
• Familiar Business Workflow: The interface functions like a standard project management and milestone portal. The blockchain operates entirely behind the scenes as a secure settlement layer and an immutable audit trail

What this changes for each side

• The company cannot quietly walk away. The money is already committed before the student starts.
• The student cannot hand in placeholder work. The review checks the submission against what was actually asked for, not against a promise.
• Neither side pays a network fee. A relayer covers gas, so a student never has to acquire SUI to get paid in stablecoins.
• The rule is not enforced by our interface. The 80-point gate is an assert! inside the Move contract, so it holds even if someone bypasses the app and calls the contract directly.

The part students don't have today

Every completed job emits a MilestoneAuditedEvent on chain carrying the AI review ID, the score and the amounts paid. That record is permanent, public, and independent of us. It is the portfolio evidence students currently have no way to produce, and it survives even if TrustMesh disappears.

Live on Sui Testnet

• Package: 0x65220b62...1775ff8
• End-to-end run, live AI review scored 81 and the escrow released: HKajqi4PVB7...mr83Qej
• Code: github.com/jijo-jiji/muba-hack

Challenges we ran into

1. Sui switched off the transport our app was built on, two days before the deadline.

Our entire frontend stopped talking to the chain at once. Every call came back with:

Method not found. JSON-RPC on public fullnodes has been deprecated.

Sui has been retiring JSON-RPC through 2026, and @mysten/sui's SuiClient speaks exactly that from the browser. So getCoins, executeTransactionBlock and tx.build({ client }) all died together. No environment variable could fix it.

How we got past it. Migrating properly to gRPC or GraphQL was a multi-day job we did not have. What saved us was noticing that the Sui CLI still works, because it does not use JSON-RPC. We moved every chain-touching operation behind our own server and had that server drive the CLI:

• on-chain USDC balance reads
• the Mock USDC faucet
• the milestone release itself

It is not the architecture we would ship, and we say so plainly in the README. But it meant a real transaction landed instead of us demoing a mock.

2. We caught our own app inventing proof.

Our first working build was largely AI-generated. When we sat down and actually read it, we found that whenever a transaction failed, it would:

• generate a random 64-character hex string
• call it a transaction digest
• set the status to "success"
• render a SuiScan link that went nowhere

In the same file, execution time was clamped with Math.min(480, Math.max(160, ...)), so any slow call displayed as under 500ms while our README advertised sub-500ms settlement as a headline feature.

How we got past it. None of it was deliberate. It was demo-safety scaffolding that had quietly turned into a lie. We tore it out and replaced it with an explicit not_executed status carrying a plain-language reason, then made one rule non-negotiable:

No digest and no explorer link ever appears unless a transaction was genuinely confirmed on chain.

That rule then caught two more instances we had missed: hardcoded per-model latencies sitting inside a panel we had named "Transparency Dashboard", and canned AI results that now carry a visible "Demo data, not a live Gonka call" badge. The README has a "what is real and what is simulated" table for the same reason.

3. Our demo could not tell its own story.

We built the product as a single dashboard with a persona dropdown. We only spotted the problem while rehearsing the pitch: our whole argument is a three-party trust story, but the demo was one person clicking every button in one window. The first question any judge would ask is "wait, who is clicking that?"

How we got past it. We split it into real /company and /student routes with permissions enforced server-side, including ownership checks so a student cannot reach another student's job by editing the URL. It improved the architecture, but the reason we did it was the pitch.

4. A vault pays out exactly once, which we learned the hard way.

release_audited_milestone sets is_active = false, so our second rehearsal aborted with Move error code 103. That is correct behaviour, since a company should never be charged twice for the same job, but it means every full run consumes a vault.

How we got past it. We wrote scripts/new-escrow-vault.sh to mint funds and create a fresh vault in one command, and added it to the reset instructions in the README.

5. One hour lost to a signing bug that was not a signing bug.

The Sui TypeScript SDK wants the raw 32-byte secret key base64-encoded. The Sui CLI exports bech32, starting suiprivkey1.... Pasting the CLI output straight into the env file fails in a way that looks like a cryptography problem and is actually a formatting one.

How we got past it. Decode first, then re-encode:

decodeSuiPrivateKey(kp.getSecretKey()) → toBase64(secretKey)