Where Transit Trust Starts
A tamper-evident delivery box with on-chain escrow — protected from dispatch to doorstep.
The problem
Nobody in a delivery can verify anybody.
When a sealed package arrives wrong, there is no neutral, evidence-backed way to say who is at fault, and no consequence for the party who caused it. The courier holds the goods with nothing at stake, so disputes come down to one side's word against another's.
The buyer
Cannot prove the box was opened in transit, and waits on a claims process to get a refund.
The seller
Cannot prove they shipped the right item, or that the courier did not swap it.
The courier
Cannot prove they never touched it, so honest couriers are blamed by default.
Tamper tape leaves a photo, GPS trackers show where but not whether it was opened, and platform refunds put the decision with an interested party. TamperSafe makes detection, evidence and settlement one system.
Why blockchain, and why MST
The referee cannot be one of the parties.
A database run by the platform can be edited by the platform. An on-chain state machine and an anchored log cannot be changed silently, so the money and the record live on MST Testnet.
Neutral custody
TamperSafeEscrow holds the buyer's payment and the courier's bond. No party controls it.
Rules fixed in advance
The relayer can only trigger defined transitions and never chooses a payee, so even a compromised relayer cannot send funds to itself.
A public audit anchor
Each box's hash-chained log head is anchored on-chain, so the anchored point cannot be quietly rewritten.
Slashing without discretion
On a tamper the buyer is refunded and the courier's bond is slashed to the seller by rule, not by a support agent.
| Contract | MST Testnet address | Role |
|---|---|---|
| TamperSafeEscrow | 0xC876A0F58592BE567081a752a0Ad53106EFD1223 | Holds funds, runs the order state machine |
| BoxRegistry | 0x45fCCe56c139b28655A3b7083f98e41C6c36E04d | Registers boxes, binds one active order each |
| TelemetryAnchor | 0x6D7Ea16170Bd03685Efad614526d9C38849C9a86 | Anchors log heads, records evidence alerts |
Wallet: the dashboard prefers BridgeKey, the official MST wallet, for connect, network switching and signing. The transaction hashes from a tamper run on the real box are listed in the README.
On-chain evidence
Every important moment is marked on MST until delivery.
The box reads its lid, motion, tilt, location, time and signal continuously. Raw readings stay off-chain to keep gas low, and the moments that matter are put on the chain, so the whole journey can be proven afterwards.
An anchored log
Every reading is hash-chained on the box, and the chain head is anchored on MST periodically and at every key event. Any single reading can be proven against it.
Highlighted events
Sharp or high motion, unnatural sustained motion or tilt, a route deviation, a lost signal or a wrong delivery key each become their own on-chain alert. Alerts are evidence; only a tamper moves money.
A stamped delivery
The delivery event carries the final log head, the delivery location and whether a GPS fix was present, so the last mile is on the record too.
The prototype records the lid sensor, tamper and the delivery key today, with location shown through a simulated route. The same recording scales to any sensor on any vehicle.
One protocol, many forms
From a parcel box to ships and trucks.
Sense, latch, report, settle. The prototype proves the loop on one box. The escrow, relayer, evidence log and dashboard do not care what the container is, so the same protocol scales to anything that travels.
Parcel box
IR lid sensor, shock and tilt, reboot counts as tamper, an RFID delivery key and an RGB status LED, settling on MST Testnet today.
Trucks and trailers
Cargo-bay door contacts, cargo-area motion, route deviation and a live location trail over cellular.
Ships and containers
Door and bolt-seal integrity, dwell and port events, and an anchored record across a whole voyage.
Pallets, crates and packages
Strap tension, tilt, shock and lid sensing on any size of unit, with the same settlement layer behind it.
The settlement and evidence layer is written once. Every new form only adds sensors, so any carrier, any cargo and any route share one neutral layer.
What it does not prove
Honest limits.
- The depot seal is the trust point: a wrong item packed at origin still passes as clean.
- The relayer is a trusted oracle. It cannot name a payee, but it could falsely report a tamper. Device-signed events verified on-chain are the fix.
- Verify log currently compares the relayer's stored log head with the on-chain anchor; an independent recompute is still to come.
- This is a prototype: it proves the lid sensor, the delivery key and the escrow loop, with a simulated location and a logical latch. Temperature, contents and weight sensing are next.
The full status table, trust model and business model are in pitch.md. Built for the MST Blockchain x NEWRRO Buildathon; AI usage is described in the README.
Lock. Monitor. Settle.
Smart lockbox, telemetry relayer, and on-chain escrow.
Continuous transit verification from dispatch to doorstep.
Automatic tamper penalty and refund, by contract rule.
Whether buying, delivering, or shipping — trust is on-chain.
Hardware Box
Custom Neurick ESP32-S3 box with IR lid sensing, 6-axis shock detection and an RFID delivery key for the buyer.
The box locks at the depot; a lid opened in transit is latched within a fraction of a second.
Real-time OLED display and persistent flash latch keep the tamper state through reboots and power loss, until the depot resets the box.
On-Chain Escrow
Autonomous settlement on MST Testnet.
Buyer payment is locked in TamperSafeEscrow upon dispatch.
Courier posts a bond. Clean delivery pays the seller; any tamper refunds the buyer and slashes the courier's bond to the seller.
Live on MST Testnet: TamperSafeEscrow, BoxRegistry, TelemetryAnchor
TamperSafe Core Security
Physical tamper detection, HMAC telemetry, and smart contracts combine into one loop: the box's report, not a support agent, decides the payout.
The result: a hash-chained record of custody, automatic tamper penalties, and escrow that only defined rules can release.
Autonomous On-Chain Escrow
No operator holds the funds. A tamper triggers the slash. Every state change is an on-chain event.