VINPassport
Prove a vehicle's history. Never show the record.
A Digital Circularity Vehicle Passport under Regulation (EU) 2026/1738, built on
Midnight's zero-knowledge blockchain.
github.com/VINPassport/VINPassport · passport.vin
A vehicle's history must be checkable by strangers,
and too sensitive to publish
Today
The history a used-car buyer sees is whatever the seller chose to print. Write-offs re-registered as clean, accidents that vanish between listings, service stamps nobody earned: each is a field moving a way it should never move, and the buyer cannot tell.
From 29 November 2026, by law
Euro 7 puts an Environmental Vehicle Passport on every new M1/N1 type from 29 Nov 2026, all new M1/N1 a year later. It opens from a QR code on the car with no app and no login, and must stay reachable for twenty years (Reg (EU) 2025/1707 Art 17(4)). Art 4(7) separately obliges manufacturers to minimise tampering with the odometer and with the passport itself.
The fuller Digital Circularity Vehicle Passport follows in September 2032 (Reg (EU) 2026/1738 Art 13). 2032 is the roadmap. Six weeks away is the customer.
The regulation demands a passport that can be checked, not one that is public. A full history is commercially sensitive to the seller and personally identifying to the owner. Publish it and one problem is solved by creating the other.
Prove claims about the record. Never publish the record.
Every field of the passport is a private commitment on Midnight. Questions are answered with zero-knowledge proofs (yes, verifiably) while the values stay where they belong.
| The question | What the chain learns |
|---|---|
| Has it ever been written off? | No, or the transaction fails |
| Has it had a reported accident? | No, or the transaction fails |
| Record a service, a reading | The field moved only the way that field may move |
| Is the mileage under 150 000 km? | Yes, and never the reading itself |
Each field carries an integrity rule fixed at creation: mileage, accidents, keepers, write-off status can never fall. The rule lives on the ledger, so nobody can pick the flattering rule at the moment they need it.
A working product, end to end
Our own Compact contract
- 7 circuits: register, initialise, record, prove-at-most, prove-at-least, plus two pure helpers that derive a field slot and a registrar identity
- A commitment per (vehicle, field); values never reach the ledger
- Claims ledger: every successful proof leaves a public, checkable record of the claim, never the value
- A claim is bound to the record version it proved; supersession is visible
Three functional surfaces: one command
- Verification: scan a QR, see the verdicts
- Intake console: fill the full regulation panel, submit into the real circuits, watch refusals render
- Proof explorer: every claim, current or superseded
- 26-vehicle demo fleet: new (BEV → diesel) and retrofit
passport.vin: the full verification surface, reading the committed ledger export · npm run app runs the compiled circuits locally
Values stay with the operator. Only proofs travel.
Type a lie into the form. Watch the circuit refuse it.
Why this matters
The refusal is not form validation: it is the zero-knowledge circuit aborting the transaction, so nothing is written and no false claim can ever appear proven.
The buyer's page then shows not proven for exactly that question: an honest absence, never a quiet "no".
Anyone can reproduce this: clone, npm run app, pick the Audi from the demo fleet, submit.
The full DCVP panel, not a demo subset
32-slot field panel (docs/FIELDS.md)
- Fraud history: mileage, accidents, keepers, write-off, services: live fields under integrity rules
- Art 13 identity: category, fuel type (BEV→diesel), type approval, emissions class, registration dates
- Art 6 / 10 declarations: recycled plastic and the share of it from end-of-life vehicles; steel and aluminium slots held for the delegated acts that will set them; CO₂ footprint; dismantling evidence
- New v retrofit: which path the passport came through, on the record
Where our passport ends: two boundaries
An EV's battery is a separate regime with its own passport (Reg (EU)
2023/1542, from Feb 2027). We carry the reference: slot 29,
batteryPassportId: and never restate the battery's claims.
The Euro 7 EVP is also separate, and we read its parameter table rather than assume it. Appendix 1 to Annex V is about twenty type-approval and emissions values, fixed at approval. We hold two, and the odometer is not an EVP parameter at all: it reaches us through Art 4(7)(d) anti-tampering and the Art 4(10) lifetime-values regime.
Both boundaries get one answer: interoperate, do not absorb. Separate section roots under one top root, because they are different documents on different clocks.
Every declaration anchors under a salted content root: it commits to everything and reveals nothing, including which slots are filled.
Tested like it matters, honest about what a proof means
The numbers
128 contract tests against the compiled circuits, same assertions that reject a transaction on chain
+155 app tests · +24 SDK assumption assertions
- Mutation-checked: every guard deleted in turn, recompiled, re-run. 25 of 25 killed
- Reproduces byte-identically from source, toolchain pinned exact
- Proving measured, wasm: register 17.5s · at-most 27.6s · at-least 27.0s · initialise a field 37.4s. Paid at issue, not at verification. Initialising is the most expensive and the most repeated, which is the ceiling Wave 3 goes after
What we do not claim
A proof shows a value is the anchored one and satisfies a bound: not that it matched physical reality when written. The registrar is trusted for that, which is why every passport names one.
So VINPassport today makes fraud attributable and tamper-evident: never "impossible". Closing the last gap means the value is written by a party already accountable for it: work we have not done, and do not imply we have.
Built on Midnight, with ODATANO: precisely
Ours
- The Compact contract: eleven circuits, eight of which prove, its own ledger and three integrity rules. Not a fork of
attestation-vault - The 32-slot vehicle field panel: a vehicle-domain design
- All three surfaces, the demo fleet, the tests
ODATANO, in three ways
@odatano/dpp-sdk: key derivation, value scaling, Merkle construction@odatano/nightgate-tx: transaction building, batch ordering, in-process proving - against our own key- Hosted NIGHTGATE sponsored our first two deploys under a metered grant, Wave 1 on 28 Aug and the Wave 2 contract on 13 Oct. The grant allowed two and both are spent, so every redeploy since has been self-funded from DUST this project's own wallet generates. Live at
2f66c442…e5d648f5, 16 Oct - Running fees are not sponsored: the demo pays its own DUST. Every transaction was already built, proven and signed our side, so no witness ever leaves
Not used: CAP service, OData layer, attestation-vault, disclosure grants. Tiered disclosure was deferred on purpose: a passport that cannot tell one writer from another is not worth adding tiers to.
Mandated demand, fiat-only revenue, free verification
The model
- Who pays first: the manufacturer, who must issue a passport anyway: the question is whose. They are not buying the passport, which must be free, but the ability to meet the obligation without publishing what they would rather not
- Then it travels: franchised dealerships maintain it under the same agreement. Second-hand dealers extend and present it at resale, where a clean-history proof is a sales tool they cannot fake today
- What is free: verification, always. Every scanned QR is a buyer learning to demand proof: the adoption engine
- Every payment is fiat. No customer ever holds crypto, sees a wallet, or pays a gas fee: fees are sponsored from a VINPassport treasury
Why the demand is not speculative
The near-term date is not 2032. From 29 November 2026 every new M1/N1 type needs an Environmental Vehicle Passport (Euro 7); the battery passport follows in February 2027, the full passport in September 2032. The cascade starts where the obligation starts: second-hand dealers are stage 3, inheriting passports rather than adopting a new system.
Honest about pricing
Unit cost is measured, not assumed. On chain it is negligible: NIGHT is never consumed, so about USD 331 of held NIGHT supports a thousand vehicles a day. The real cost is proving, and that is what Wave 3 goes after.
Two products, not one. The regulated EVP is twenty static values, priced at issue. Provenance is voluntary and is where lifetime cost lives. Conflating them was the mistake the measurement caught.
Each wave states its delta in advance, and reports it after
| Wave 2 shipped |
A second contract that closes the limits we named, live on preprod: register and initialise gated on a registrar identity derived in-circuit, an allowlist pinned at deploy, field commitments bound in-circuit to the content root, a third integrity rule with the field registry widened from 5 to 68, a circuit that compares two of a vehicle's own hidden fields and publishes neither, and every guard mutation-checked, 25 of 25. Deployed 16 Oct 2026, block 2999411. Cost measured with real proofs: 0.81 DUST at the protocol reference price to register a vehicle and initialise the five fields the demo writes, and 27.6s in wasm to issue a claim. A vehicle carrying the whole 68-field registry is a different and much larger number, which is the throughput work Wave 3 is about |
|---|---|
| Wave 2 deferred |
The NIGHTGATE integration: tiered disclosure, disclosure grants, live browser reads, the CAP service layer. Named for Wave 2 and held back on purpose, because a passport that cannot tell one writer from another is not worth adding tiers to. documentComparison waits on more than one anchored root per vehicle |
| Wave 3 | Composition & commerce: the battery passport link exercised against NIGHTPASS end to end, cross-root integrity in the product flow, the dealer workflow, fleet view, and one real pilot conversation |
| Horizon | Closing the trust gap: a proof inherits the trust of whoever wrote the value, so the open problem is provenance of the writer, not tamper resistance. Authoritative sources - registries, testers, insurers - writing under an accountable identity, and marking that lets a verifier tell an authoritative write from a self-declared one. That distinction becomes the product |
Scan a car. Get a verdict. Trust the math, not the seller.
passport.vin: live demo · deploy/preprod.json: the preprod contract · docs/DEMO.md: the walkthrough · Apache-2.0, fully open source