Home / Technology

Technology, contracts and security

Apps call off-chain services. Only signed attestations and payment instructions reach ten small contracts on Ramestta. A contract cannot see a tree, so it checks that an authorised verifier signed the result.

System architecture diagram
Architecture: four layers and ten contracts on Ramestta.
Architecture

One job per contract

  • Chain: Ramestta with RAMA for gas. This deployment settles quoted sponsor payments and payouts in USDT through FundingVault.
  • Data: PostgreSQL with PostGIS for geospatial uniqueness; object storage for evidence; IPFS for NFT media and metadata.
  • Indexer: reads contract events into the database so apps and the public dashboard stay fast and consistent with the chain.
  • Mobile app: recommended Android first for planters, with offline capture, then iOS.
  • Separation of duties: no single service or admin can both approve proof and release funds.
Custody modesFundingVault holds the USDT deposit; indexed journal entries are reconciled with vault assets and liabilities. RAMA is gas only.
Smart contracts

Ten contracts and what they do

ContractResponsibilityKey functionsWho can callKey events
ProjectRegistryApproved projects, sites, land-consent references, partner linkcreateProject, approveSite, suspendProjectPartner admin, platform multisigProjectCreated, SiteApproved, ProjectSuspended
FundingVaultHolds sponsor funds (on-chain mode), locks obligations, refunds; commitments only in fiat modedeposit, lockForTask, refundSponsor (deposit); contracts for locks and refundsDeposited, Locked, Refunded
TaskAllocationTask creation, planter assignment, statuscreateTask, assign, markSubmittedPartner admin, assigned planterTaskCreated, TaskAssigned, TaskSubmitted
ProofRegistryEvidence hashes, verifier decisions, appealssubmitEvidenceHash, attest, reject, appealPlanter (submit); accredited verifier (attest, reject)EvidenceSubmitted, Attested, Rejected, Appealed
MilestoneSettlementReleases planting, survival and maintenance paymentssettle, settleMaintenanceOnly after a valid attestationSettled, MaintenanceSettled
LivingTreeNFTERC-721 certificate; status history; metadata versionsmint, updateStatus, setMetadataVersionProofRegistry-approved callersTreeMinted, StatusChanged, MetadataUpdated
ImpactMarketplaceListings, offers, sales, royalty routinglist, buy, offer, cancelToken owner, buyerListed, Sold, OfferMade
FeePolicyRegistryVersioned payout and royalty rules per transaction typepublishPolicy, activatePolicyPlatform multisig through timelockPolicyPublished, PolicyActivated
PartnerRegistryAuthorised NGOs, verifiers, accreditation and statusaddPartner, setAccreditation, revokePlatform multisigPartnerAdded, AccreditationChanged
ProtocolTreasuryOperating funds and fee collectionwithdraw (limits), setSignersMultisig with timelockFeeReceived, Withdrawn

Design rules

  • Audited libraries, reentrancy guards, pull-style payouts.
  • Upgrades only through a timelock and a multisig, announced before they take effect.
  • A verifier cannot be paid on a task they verify; no role can both attest and settle.
  • A pause stops new settlements and listings; it never blocks refunds.
  • Raw images and personal data never go on-chain.

Invariants that are tested

  1. Released plus refunded never exceeds deposited or committed.
  2. A task settles at most once per milestone.
  3. A Tree ID maps to one NFT, which keeps its history.
  4. A policy version never changes after activation.
  5. Only accredited verifiers can attest.
  6. Payout shares sum to the amount settled.
Recommended stack

Built with proven tools

LayerChoice
Web portalNext.js with React and TypeScript, multilingual, server-rendered public pages
Field appReact Native or a native camera module; offline queue, secure upload, device-integrity signals
Core APITypeScript on Node.js, typed REST with OpenAPI, role- and tenant-aware authorisation
DatabasePostgreSQL with PostGIS; append-only payout journal; event outbox
MediaPrivate encrypted object storage with content hashes; public IPFS mirrors; replicated backups
Async jobsQueue for malware and media screening, risk scoring, notifications, indexing and scheduled checks
ChainSolidity on the Ramestta EVM, OpenZeppelin base, indexed events with reorg handling
Auth and keysOIDC or passkeys for web; wallet-signature sign-in where needed; multisig for the treasury
ObservabilityAudit logs, tracing, error monitoring, service-level dashboards, disaster-recovery drills
Threat model

Threats and controls

ThreatControl
Deepfake image or GPS spoofSigned challenge, media hashes, risk flags, human review, independent site audit
Many-wallet voting (Sybil)Identity and reputation rules, rate limits, random assignment, expert tie-break
Same tree claimed repeatedlyTree ID, coordinates, geospatial dedupe, before-and-after similarity, site capacity
False partner or fake landLandowner authorisation, NGO due diligence, third-party site proof
Payout diversionBeneficiary bound to the payout, separate approvers, time delay, signed policy
NFT wash tradesSelf-trade analytics, affiliated-account detection, no volume incentives
Personal data or GPS exposurePrivate storage, blurred public location, least privilege, consent, retention rules
Smart-contract exploitAudit, invariant and fuzz tests, reentrancy locks, bounded emergency controls
Verifier collusionRandom field audits, conflict disclosure, separate appeal reviewers, a stated sampling method
Launch gates

Production go-live needs all ten

Tick the boxes to see the readiness bar. This is a planning aid; a ticked box is the team's own record, not an independent certification.

0 of 10 gates ticked