A selfie is not proof. Payment, NFT minting and every survival milestone depend on four layers of evidence. A smart contract only records the signed result; it cannot see a tree.
Live-camera capture only (no gallery upload). GPS with an accuracy value, server receive time, device attestation, a random challenge word or object in frame, planter ID and an authorised-site check.
Blocks: nothing is paid on an unsigned submission.
Duplicate and near-duplicate image matching, EXIF and timestamp consistency, location inside the approved site polygon, impossible-travel check, overlap with existing Tree IDs and species plausibility.
Result: flagged items go to level 3 with higher priority.
A qualified verifier approves or rejects. Community reviewers add an extra signal on a random sample. High-risk or high-value cases get a field audit. Appeals go to a second verifier.
Blocks: the planting milestone payment and the NFT mint.
Scheduled re-photos from the same spot, inspector visits and plot-level satellite or drone checks where resolution allows.
Blocks: survival and maintenance payments.
The app asks for the required steps in order, then builds the planting GIF from the verified frames (2 to 5 images).
See the planter app prototype.
| Scenario | Defence |
|---|---|
| AI-generated or edited planting photo | Live capture, challenge word, device attestation, duplicate and metadata checks, field audit sampling |
| Spoofed GPS | Accuracy threshold, site polygon check, mock-location detection, impossible-travel rule, inspector re-check |
| One planter photographs one tree many times | Perceptual hashing, Tree ID uniqueness in PostGIS, minimum distance between trees of the same task |
| Reviewers colluding to approve | Random assignment, reputation loss, verifier decides, audits on sampled approvals |
| Verifier and planter in the same network | Conflict-of-interest flag; a verifier cannot review linked accounts or the same organisation |
| Tree dies after the NFT is sold | Survival milestones, Dead and Replaced status on the NFT, replacement warranty |
| Land owner revokes consent | Land consent record with expiry; project suspended and funds protected |
Pilot defaults to tune with real partners. There is no money-based slashing in the MVP, and community votes are a supporting signal, never final approval.
| Rule | Pilot default | Why |
|---|---|---|
| Community reviewers per task | 7 assigned at random; a quorum of 5 signals | Enough spread to catch collusion without needing 50 votes |
| Reviewer points | +1 for a completed review; +2 more when the signal matches the final verified outcome | Rewards accuracy, not volume |
| Point stake | Each review locks 1 point until the outcome is final | A cost for careless signals, with no money at risk |
| Wrong signal | -2 points; a pattern lowers priority, then removes assignment rights | Reputation, not seizure |
| Confirmed fake or colluding signal | Suspension, review by the platform admin and a second verifier, points reset | Needs a verified finding, not just a disagreement |
| Verifier decision time | 3 working days from assignment, then reassigned | Keeps payouts moving |
| Appeal window | 7 days after a rejection; a second, unlinked verifier decides within 7 days | A fair second look |
| Independent audit | 100% field attestation for a new partner; at least 10% random re-inspection for a trusted partner | Trust is measured, not assumed |
| Verifier conflicts | Cannot review their own organisation's tasks; pay per completed review, not tied to approval rate | Removes any reward for approving |
| Failed audit | Partner returns to 100% attestation; affected tranches are held | A proportionate consequence |