Different app, different ID
The same wallet becomes a separate host identifier for each allowed origin.
Hosts get a scoped ID and verdict, not the Stellar address.
Public account
The same address can appear across services.
Challenge
single use
Origin
scoped
Wallet
withheld
Default wallet login leaks too much
A normal wallet login gives the host a public account it can reuse and inspect. VeilPass returns only the access fields the host needs.
| Host can learn | Wallet login | VeilPass |
|---|---|---|
| Stellar wallet address | ||
| Public account activity | ||
| Same ID across apps | ||
| Gate eligibility verdict | ||
| Origin-scoped returning ID |
Reviewer path
Run App A, switch to App B, then test replay and revocation. The product shows the exact point where the wallet stops.
The same wallet becomes a separate host identifier for each allowed origin.
Replay attempts hit the spent-challenge path instead of creating another session.
The host receives the verdict fields it needs and nothing that identifies the wallet.
The exact boundary
Sees the Stellar address during enrollment and signs the credential.
Checks eligibility and derives a private ID scoped to one origin.
Receives a verdict and scoped ID, never the wallet address.
Evidence package
The repo keeps the contract ID, test matrix, screenshots, and proof limitation notes close to the product code.
Soroban gate deployed on Stellar Testnet
Unit, e2e, a11y, build, and contract smoke are wired
Privacy model and limitations stay visible
Host response
The verifier returns fields that support access control. It does not return the wallet address.
{
"ok": true,
"privateAppId": "vp_appA_72f1",
"gateId": "premium-holder",
"epoch": 1,
"origin": "https://app.example",
"expiresAt": 1760000000000
}FAQ
Short answers for the privacy, deployment, and proof claims that need clean edges.
No. The issuer still sees the wallet during enrollment. VeilPass keeps the wallet address out of the host response and gives each origin its own private app ID.
Yes. Vercel should use frontend as the project root. Keep the contract workspace at the repo root and configure production env vars in Vercel.
The MVP ships a deterministic proof adapter labeled Simulated proof. The Noir circuit boundary is included for the future ZK path and is not misrepresented as production ZK.
The host receives an eligibility verdict, gate ID, epoch, expiry, origin, and a private app ID scoped to that origin. It does not receive the Stellar wallet address.
Open the controlled bench, replay a spent challenge, then revoke the gate and watch verification fail.
Open the demo