ZeroSeal

Private evidence. Public proof. Verifiable rewards.

ZeroSeal helps security researchers seal sensitive vulnerability evidence locally, prove when a claim was recorded, create a wallet-authorised Stellar receipt and connect a confirmed claim to a verifiable researcher reward.

ZeroSeal is built for bug bounty hunters, auditors, security programmes and protocols that need a trusted record before sensitive exploit details are disclosed.

Live product: https://zeroseal.vercel.app

Repository: https://github.com/yungthacreator/zeroseal

ZeroSeal currently runs on Stellar Testnet. It is a working demonstration and must complete further security review before any mainnet deployment.

1. What Problem ZeroSeal Solves

A researcher may need to establish that a security claim existed before revealing the full exploit. Sharing the full report too early can expose reproduction details before a programme has triaged the issue.

A security programme needs enough public information to identify, inspect and prioritise a claim without forcing sensitive reproduction details to become public before they are ready to receive them.

ZeroSeal creates a shared, verifiable record between those two needs. A confirmed receipt shows that a claim with specific approved fields existed at a specific ledger. It is not a legal proof of authorship and it does not guarantee priority over another report.

2. How ZeroSeal Works

1. Choose the intended reporting path and target.
2. Prepare a safe public description of the finding.
3. Keep the full report, proof of concept, reproduction steps and private files local.
4. Generate cryptographic commitments from the approved claim state.
5. Review and approve the exact fields that may become public.
6. Authorise the Stellar Testnet transaction and receive a confirmed public receipt.
7. Connect the confirmed receipt to a direct or split researcher reward.

The sensitive report is not submitted to the reporting platform by ZeroSeal and is not placed in the public receipt.

3. Live Product Capabilities

• Browser-based security claim workspace.
• Reporting paths for common disclosure workflows and direct project reports.
• Local handling of raw vulnerability evidence.
• Cryptographic commitment generation.
• Exact public-field review before submission.
• Freighter wallet authorisation.
• Stellar Testnet claim registry submission.
• Confirmed public receipt creation.
• Receipt verification by receipt ID, claim ID or transaction hash.
• Public claim activity with Stellar transaction links.
• Direct researcher rewards using Testnet XLM.
• Atomic split rewards for a researcher and collaborators.
• Independent reward verification using public Stellar data.
• Shareable payment-proof links.

4. Privacy Boundary

Remains private	May appear in the public record
Full vulnerability report	Researcher wallet
Proof of concept	Approved public title
Reproduction steps	Reporting context
PoC notes	Target information
Private files	Severity claim
Private impact values	Approved public impact statement
Salts	Researcher commitment
Witness values	Claim commitment
Secrets	Nullifier
Unpublished exploit mechanics	Registry contract
	Transaction hash
	Ledger
	Network
	Public policy identifier

ZeroSeal publishes commitments and approved metadata, not the raw evidence used to produce them.

5. Public Receipts and Verification

A confirmed receipt can be inspected without connecting a wallet. Anyone can verify a receipt by:

• Receipt ID
• Claim ID
• Transaction hash

The verification surface shows the public claim, researcher wallet, commitments, ledger, registry contract and the confirmed Stellar transaction. Verifying a receipt confirms that the recorded claim and transaction are real and unaltered. It does not confirm that the underlying vulnerability is valid.

6. Researcher Payments

A confirmed receipt can be connected to:

• A direct researcher reward.
• An atomic split reward for multiple contributors.
• A shareable payment-proof page.
• Independent verification from public Stellar data.

Some practical details:

• Payments currently use Testnet XLM.
• Freighter is required to authorise a payment.
• A wallet connection is not required to verify a confirmed payment.
• The payment recipient comes from the researcher wallet recorded in the confirmed receipt.
• A payment does not automatically prove programme approval or vulnerability validity.
• Reward verification is reconstructed from public Stellar data and is not yet permanent backend reward persistence.

7. Architecture

• Next.js frontend for claim preparation, public receipts, verification and public activity.
• NestJS API for claims, receipts, continuations, reconciliation and verification.
• PostgreSQL and Prisma for persistence.
• Soroban Claim Registry contract for submit_claim.
• Soroban verifier contract for the current verification surface.
• Freighter wallet for Stellar Testnet authorisation.
• Stellar Horizon and RPC for submission, reconciliation and public transaction data.
• Local browser handling of raw private evidence.
• Backend transaction reconciliation after confirmed Stellar Testnet transactions.
• Current proof preparation and structural proof handling, which is partial and will be strengthened as verification work continues.

8. Current Testnet Contracts

All resources below are Stellar Testnet resources and are not deployed to mainnet.

Claim Registry contract:

CD6MKUVXB7ZTZQCGNMBVHMU4PGT2SEKS6Z5LF53HXDOAVCO3LGKGQ3JU

Verifier contract:

CABBWKKUU4PWWU5LSV2BPUMIEZR542V36WONDA2UT6OHXJWZAPXIKA2X

Confirmed regression receipt:

zs_9f4c17af-8aae-4c4a-bebf-55c3c2d33f16

9. Local Development

Production URL: https://zeroseal.vercel.app

Install dependencies:

npm install

Start local infrastructure:

docker compose -f docker-compose.dev.yml up -d

Generate the Prisma client and apply migrations:

npm.cmd --prefix apps/api run prisma:generate
npm.cmd --prefix apps/api exec prisma migrate deploy

Run the API:

npm.cmd --prefix apps/api run dev

Run the web app:

npm.cmd --prefix apps/web run dev

Required environment values include database, Redis, API URL, Stellar Testnet RPC and contract IDs. Do not commit real secrets or private keys.

10. Roadmap

Planned items, not yet live:

• Claimable bounty.
• Confidential bounty escrow.
• ZK proof of bounty funds.
• Confidential and stablecoin rewards.
• Programme API and SDK.
• Duplicate claim coordination.
• Stronger cryptographic verification.
• Mainnet readiness after security review.

11. Security and Product Boundaries

ZeroSeal:

• Does not publish private evidence.
• Does not replace responsible disclosure.
• Does not determine whether a vulnerability is valid.
• Does not automatically assign severity.
• Does not legally prove authorship or ownership.
• Does not guarantee bounty payment.
• Does not automatically detect semantic duplicates.
• Currently runs on Stellar Testnet.
• Requires further security review before mainnet deployment.

12. Open Source and License

ZeroSeal is open source under the MIT License. See LICENSE.