Blockchain Credential

Context

Paper certificates are easy to forge, while putting a whole credential on a blockchain exposes personal data that can never be deleted. The approach here: put on-chain only what's needed to prove a credential hasn't been altered and is still valid.

Problems & solutions

1. 01

   Only the fingerprint goes on-chain

   Credential content is canonicalised, hashed with SHA-256 and signed with Ed25519. Only the hash (contentHash) and the status are written to the CredentialRegistry smart contract. Personal data stays off-chain.

2. 02

   Verification without logging in

   Each credential comes as a PDF with a QR code containing only a /verify/{public_id} link. A verifier scans the QR code or uploads the JSON file and gets one of nine results, from VALID, REVOKED and EXPIRED to TAMPERED or INVALID_SIGNATURE. When a credential is revoked, the old QR code still works and now returns REVOKED.

3. 03

   Keeping the wallet out of the main application

   Laravel handles the business logic; a separate gateway written in Node, Fastify and ethers v6 holds the issuer's EVM wallet and is the only thing that talks to the chain. The payload follows the W3C VC 2.0 data model.

4. 04

   Testing and measurement

   CI runs Pint, Larastan and Pest for the backend, Hardhat tests for the contract, Vitest for the gateway, and gitleaks to stop secrets leaking. A quantitative experiment suite, E1–E5, runs on a synthetic dataset with a fixed seed so results are reproducible.