Truthopi

note (this is the public version ... basiclly i just made claude create a safe version to share publicly) A blockchain-verified photo and video authenticity system. Capture media on mobile, hash it (SHA-256), store the hash on an Ethereum smart contract, and independently verify authenticity — all with an open, auditable pipeline.

Architecture

┌─────────────┐     ┌──────────────┐     ┌────────────────┐
│   Flutter    │────▶│   FastAPI     │────▶│   Ethereum     │
│  Mobile App  │     │   Backend     │     │ Smart Contract │
└─────────────┘     └──────┬───────┘     └────────────────┘
                           │
                    ┌──────┴───────┐
                    │  PostgreSQL  │
                    │  (Supabase)  │
                    └──────────────┘
                           │
┌─────────────┐     ┌──────┴───────┐
│   Next.js    │────▶│  S3 / DO     │
│   Website    │     │   Spaces     │
└─────────────┘     └──────────────┘

Layer	Tech
Mobile	Flutter (Android / iOS) with Clerk auth, Google Sign-In, Play Integrity, camera capture
Backend	Python FastAPI, PostgreSQL (Supabase), S3/DigitalOcean Spaces for video
Website	Next.js with Clerk auth, photo dashboard, public verification page
Smart Contract	Solidity (Foundry framework), deployed on Ethereum Sepolia testnet

Security Features

• ✅ Device attestation (Android Play Integrity + iOS App Attest)
• ✅ C2PA hardware trust verification (e.g., Sony cameras)
• ✅ Blockchain hash anchoring (tamper-proof)
• ✅ Chained audit logs (tamper-evident)
• ✅ Secure crypto (bcrypt, SHA-256, timing-safe comparison)
• ✅ CORS restrictions (environment-based)
• ✅ Security headers (CSP, X-Frame-Options, etc.)
• ✅ HTTP-only cookies (XSS protection)
• ✅ Secure mobile storage (Keystore / Keychain)
• ✅ SQL injection prevention (ORM)

Getting Started

Prerequisites

• Python 3.10+
• Flutter 3.x
• Node.js 18+
• Foundry (for smart contract development)

1. Clone the Repository

git clone https://github.com/YOUR_USERNAME/Truthopi.git
cd Truthopi

2. Backend Setup

cd backend
python -m venv venv
source venv/bin/activate   # Windows: venv\Scripts\activate
pip install -r requirements.txt
cp .env.example .env       # Fill in your actual values
uvicorn main:app --host 0.0.0.0 --port 8000 --reload

3. Smart Contract Setup

cd chain
cp .env.example .env       # Fill in your actual values
make deploy-anvil          # Local deployment

Note: Copy the Deployed to: 0x... address from the output and set it as CONTRACT_ADDRESS in backend/.env.

4. Website Setup

cd website
npm install
cp .env.example .env       # Fill in your actual values
npm run dev

5. Mobile App Setup

cd mobile_frontend
cp .env.example .env       # Fill in your actual values
flutter pub get
flutter run

Note: For local development, use ngrok to expose your backend and set the tunnel URL in mobile_frontend/.env.

Running the Full System Locally

To run the complete system, open separate terminals:

Terminal	Command	Purpose
1	make anvil (in chain/)	Start local Ethereum node
2	make deploy-anvil (in chain/)	Deploy the smart contract
3	uvicorn main:app --host 0.0.0.0 --port 8000 --reload (in backend/)	Start the API server
4	ngrok http 8000	Expose backend to mobile
5	npm run dev (in website/)	Start the website
6	flutter run (in mobile_frontend/)	Run the mobile app

Testing

Smart Contract Tests

cd chain

# Unit tests
forge test --match-contract TruthopiTest -vv

# Integration tests
forge test --match-path test/integration/* -vvv

Manual Blockchain Interactions

# Store a hash on-chain (simulates backend behavior)
make store-anvil

# Verify a hash on-chain
make cast-verify CONTRACT=<DEPLOYED_ADDRESS> HASH=<IMAGE_HASH>

Backend Tests

cd backend
./run_tests.sh

Public Transparency & Trust

All critical security, auditing, and hardware verification mechanisms are fully open source.

Audit System

• Chained audit logs — altering any past record mathematically invalidates all subsequent entries
• Public API — /public/audit and /public/version endpoints allow independent verification without authentication

Cryptography & Attestation

• Play Integrity — validates requests originate from a genuine, untampered Android app
• App Attest — 5-step iOS attestation proving request origin
• C2PA Verification — cryptographically verifies camera hardware trust claims (e.g., Sony cameras)

Environment Variables

Each component has a .env.example file documenting all required environment variables:

• backend/.env.example
• chain/.env.example
• website/.env.example
• mobile_frontend/.env.example

Project Structure

Truthopi/
├── backend/          # Python FastAPI backend
├── chain/            # Solidity smart contract (Foundry)
├── mobile_frontend/  # Flutter mobile app
├── website/          # Next.js web dashboard
└── LICENSE           # MIT License

Contributing

1. Fork the repository
2. Create your feature branch (git checkout -b feature/amazing-feature)
3. Copy .env.example files and fill in your own credentials
4. Commit your changes (git commit -m 'Add amazing feature')
5. Push to the branch (git push origin feature/amazing-feature)
6. Open a Pull Request

⚠️ Never commit .env files, API keys, or secrets. The .gitignore is configured to exclude them, but always double-check before pushing.

License

This project is licensed under the MIT License — see the LICENSE file for details.