Stellar testnet · Soroban
Rent or sell a timeshare week without publishing your life
An owner who cannot travel this year has no simple way to pass the week on. Transfers are slow and broker-dependent, and a buyer cannot easily check who really holds the week or whether it carries unpaid maintenance fees. Putting it all on a public ledger fixes the trust problem and creates a new one — ownership history and travel plans become visible to everyone.
How it works
The record stays with you
Your name, the resort, the unit, the deed, the fee history. One document, held by the people it concerns. No endpoint serves it and nothing stores it for you.
Only a commitment goes on chain
32 bytes that wrap the record's SHA-256 together with your account and the hash of a secret only you hold. Nothing in it can be reversed into the record.
You prove it to move it
Renting out or selling takes a zero-knowledge proof that you know the week's secret, made on your own machine and checked by the contract on chain. Nobody approves it.
A buyer checks the rest
The issuer's signed word on fees, the holder the ledger names, and the proofs the contract accepted — in their own browser, with no account.
One transfer primitive
A sale
expires_at = None. Title moves and stays moved.
A rental
expires_at = Some(t). The week comes back on its own — no return transaction, no reminder, no trust. A renter whose term has passed is simply not the holder any more.
What reaches the ledger, and what never does
Public
- Two account addresses — pseudonymous
- A right id and its week
- A 32-byte commitment
- A proof and its public values — none of them reveal the record
- A rental's term end. A sale carries none.
Never on chain
- Your name and email
- The resort, the unit, the deed
- What you owe, and to whom
- The record itself, in any form, or the secret behind it
Checked against the real chain by npm run check-privacy, which reads the evidence transactions back and searches every layer. Not asserted — measured.
What the issuer can, and cannot, do
Cannot — enforced by the contract
- Move, reassign, freeze or burn a week you hold
- Block or approve your transfers — it has no part in them
- Overwrite a right, alter a commitment, or change the contract's code
Demonstrated on chain: the issuer tries to move a held week to itself, and a transfer signed by the holder and the issuer but carrying no proof — both refused.
Can — and it is stated, not glossed
- Issue new weeks
- Attest something untrue about a week's fees
The fee attestation is the issuer's word, shown to buyers; it never decides whether a week can move. And the proving keys come from a development setup, labelled non-production — a production ceremony is a later phase.
Reviewing this?
- Contract
CCSQRSLC34HLAXB5NSOF7AQFLD6ESSC6PG3JNZKMANZR67YCE7GDF6YD- Network
Test SDF Network ; September 2015
Everything a reviewer needs is a set of explorer links with nothing to install — the deployed contract, a proof-authorized rental and sale, and five transfers the contract refused. See docs/EVIDENCE.md in the repository. The registry itself needs a wallet; verification does not.