VINPassport
Prove a vehicle's history. Never show the record.
A Digital Circularity Vehicle Passport under Regulation (EU) 2026/1738, built on
Midnight's zero-knowledge blockchain.
github.com/VINPassport/VINPassport · passport.vin
A vehicle's history must be checkable by strangers,
and too sensitive to publish
Today
The history a used-car buyer sees is whatever the seller chose to print. Write-offs re-registered as clean, accidents that vanish between listings, service stamps nobody earned: each is a field moving a way it should never move, and the buyer cannot tell.
From September 2032, by law
Every vehicle placed on the EU market must carry a Digital Circularity Vehicle Passport: identity, provenance, history, environmental declarations (Reg (EU) 2026/1738, Art 46, in force since 13 Aug 2026).
The regulation demands a passport that can be checked. It does not demand one that is public. A full history is commercially sensitive to the seller and personally identifying to the owner. Publish it, and one problem is solved by creating the other.
Prove claims about the record. Never publish the record.
Every field of the passport is a private commitment on Midnight. Questions are answered with zero-knowledge proofs (yes, verifiably) while the values stay where they belong.
| The question | What the chain learns |
|---|---|
| Has it ever been written off? | No, or the transaction fails |
| Has it had a reported accident? | No, or the transaction fails |
| Record a service, a reading | The field moved only the way that field may move |
| Is the mileage under 150 000 km? | Yes, and never the reading itself |
Each field carries an integrity rule fixed at creation: mileage, accidents, keepers, write-off status can never fall. The rule lives on the ledger, so nobody can pick the flattering rule at the moment they need it.
A working product, end to end
Our own Compact contract
- 5 circuits: register, initialise, record, prove-at-most, prove-at-least
- A commitment per (vehicle, field); values never reach the ledger
- Claims ledger: every successful proof leaves a public, checkable record of the claim, never the value
- A claim is bound to the record version it proved; supersession is visible
Three functional surfaces: one command
- Verification: scan a QR, see the verdicts
- Intake console: fill the full regulation panel, submit into the real circuits, watch refusals render
- Proof explorer: every claim, current or superseded
- 26-vehicle demo fleet: new (BEV → diesel) and retrofit
passport.vin: anyone can start a real preprod transaction, on our dust · npm run app locally
Values stay with the operator. Only proofs travel.
Type a lie into the form. Watch the circuit refuse it.
Why this matters
The refusal is not form validation: it is the zero-knowledge circuit aborting the transaction, so nothing is written and no false claim can ever appear proven.
The buyer's page then shows not proven for exactly that question: an honest absence, never a quiet "no".
Anyone can reproduce this: clone, npm run app, pick the Audi from the demo fleet, submit.
The full DCVP panel, not a demo subset
32-slot field panel (docs/FIELDS.md)
- Fraud history: mileage, accidents, keepers, write-off, services: live fields under integrity rules
- Art 46 identity: category, fuel type (BEV→diesel), type approval, emissions class, registration dates
- Art 29 / 3R declarations: recycled plastic, steel, aluminium; CO₂ footprint; dismantling evidence
- New v retrofit: which path the passport came through, on the record
Where our passport ends
An EV's battery is a separate regime with its own passport (Reg (EU)
2023/1542, from Feb 2027). We carry the reference: slot 29,
batteryPassportId: and never restate the battery's claims.
The regulation asks these passports to interoperate. Interoperate, not absorb, a reference is what that actually looks like.
Every declaration anchors under a salted 32-slot content root: it commits to everything and reveals nothing: including which slots are filled.
Tested like it matters, honest about what a proof means
The numbers
67 contract tests against the compiled circuits, same assertions that reject a transaction on chain
+16 app tests · +24 SDK assumption assertions
- Mutation-checked: delete an integrity rule → exactly that rule's tests fail, nothing else
- Committed build reproduces byte-identically from source
- Toolchain pinned: Compact 0.31.1, runtime 0.16.0 exact
What we do not claim
A proof shows a value is the anchored one and satisfies a bound: not that it matched physical reality when written. The registrar is trusted for that, which is why every passport names one.
So VINPassport today makes fraud attributable and tamper-evident: never "impossible". Closing the last gap needs attestation at the sensor: honest future work (Wave 3+), not something we imply we have.
Built on Midnight, with ODATANO: precisely
Ours
- The Compact contract: five circuits, its own ledger and integrity rules. Not a fork of
attestation-vault - The 32-slot vehicle field panel: a vehicle-domain design
- All three surfaces, the demo fleet, the tests
ODATANO, in three ways
@odatano/dpp-sdk: key derivation, value scaling, Merkle construction@odatano/nightgate-tx: transaction building, batch ordering, in-process proving - against our own key- Hosted NIGHTGATE sponsored our deploy under a metered grant: live on preprod since 28 Aug, contract
72e52488…d553a - Running fees are not sponsored: the demo pays its own DUST. Every transaction was already built, proven and signed our side, so no witness ever leaves
Not used: CAP service, OData layer, attestation-vault, disclosure grants - the Wave 2 delta, stated in advance.
Mandated demand, fiat-only revenue, free verification
The model
- Who pays: the independent used-car dealer: our beachhead. A clean-history proof is a sales tool they cannot fake today
- What they buy: a subscription plus per-passport issuance; services and proofs metered within plans
- What is free: verification, always. Every scanned QR is a buyer learning to demand proof: the adoption engine
- Every payment is fiat. No customer ever holds crypto, sees a wallet, or pays a gas fee: fees are sponsored from a VINPassport treasury
Why the demand is not speculative
From September 2032 the passport is mandatory for every vehicle placed on the EU market: and the existing fleet gets passports retrofitted. The regulation creates the obligation; VINPassport makes compliance private.
Honest about pricing
Price points wait on measured unit cost (DUST per anchor and per proof a named Wave 2 task). The structure is already built: billing gates the action, not the chain, so pricing never touches crypto code.
Each wave states its delta in advance
| Wave 2 | A second contract that closes the limits we named: register and initialise gated on a registrar identity, an allowlist pinned at deploy, field commitments bound in-circuit to the content root, and more than one anchored root per vehicle - which is what makes documentComparison, the detector for the frauds nobody thought to ask about, buildable at all. Then the full NIGHTGATE integration: tiered disclosure (buyer / trade / authority see genuinely different views), disclosure grants, live browser reads, the CAP service layer, and measured unit economics that turn the pricing structure into prices |
|---|---|
| Wave 3 | Composition & commerce: the battery passport link exercised against NIGHTPASS end to end, cross-root integrity in the product flow, the dealer workflow, fleet view, and one real pilot conversation |
| Horizon | Closing the trust gap: sensor-signed readings from tamper-resistant hardware bind numbers to physical reality; provenance marking lets a verifier tell a sensor-attested reading from a self-declared one. That distinction becomes the product |
Scan a car. Get a verdict. Trust the math, not the seller.
passport.vin: live demo · deploy/preprod.json: the preprod contract · docs/DEMO.md: the walkthrough · Apache-2.0, fully open source