Project Introduction
Makhzan is bonded storage on Portaldot V3. A storage provider locks a tPOT bond, and if it cannot prove it still holds your data, 20% of that bond is slashed and paid to the client. Random Merkle-proof challenges decide who is telling the truth. It is ordinary Solidity (0.8.28) running on Portaldot V3 through pallet-revive, deployed and exercised live on testnet.
Problem Solved
Paying someone to store your data is a promise you cannot check. You either trust the provider or download everything to audit it. AI agents, dApps whose on-chain state points to off-chain files, and document custody all hit this. Makhzan turns the promise into an on-chain condition with real money behind it, so anyone can verify a deal without trusting the provider and without keys.
Link
Demo Video: https://www.youtube.com/watch?v=7bmQDgb0R-E
Live status app (read-only, no wallet): https://status-ui-one.vercel.app/
GitHub: GitHub - MohammedSoliman10/portaldot-hackathon-2026-makhzan-soliman: Bonded, challenge-verified storage on Portaldot V3: providers lock a bond and are slashed 20% if they miss a Merkle-proof challenge. Live testnet deploy, StorageGate consumer contract, read-only MCP agent tools. · GitHub
Pitch Deck: Makhzan pitch deck - Google 幻灯片
Contract: 0x60481DFcFCA34A8F095939D9675eC715127B2e44 (Portaldot V3 testnet, chain 420420777)
Technical Highlights
- Real slashing, measured on chain. A provider with a 30 tPOT bond skipped a challenge, the 50-block window expired, and resolve slashed exactly 20%: bond 30 → 24 tPOT, 6 tPOT paid to the client. A passed challenge leaves the bond unchanged. Transaction hashes are in the repo and on the Build page.
- Keyless verification anyone can run. The status app’s Verify page checks a file against the on-chain deal root (change one byte and it fails). The CLI commands “makhzan verify 1” and “makhzan verify 2” read the chain and print PASS. A read-only MCP server with 4 tools lets an AI agent check a deal itself.
- Other contracts can build on it. healthOf(dealId) is readable by any contract. StorageGate is a live consumer: it releases money to the provider only while the deal is healthy, before its end block, and while the bond is above a floor. The live demo ran 13 transactions, including refused releases and a refund after the term.
- Every cost is measured, and every number is machine-checked. Challenge 0.0153 tPOT, answer 0.163 tPOT, create deal 11.56 tPOT, register provider 11.54 tPOT. 889 automated tests (208 Foundry with fuzzing and invariants), and 381 facts in the docs are checked against raw receipts committed in the repo.
- New findings about V3. 12 measured findings in docs/V3-GOTCHAS.md. Two changed our design: block.prevrandao and the header mixHash are the same constant on every block we sampled, so the challenge index uses the parent blockhash and deal id; and the storage deposit is not refunded, so we deploy once. We also used the native TransactionStorage pallet to anchor a 283-byte deal manifest on V3 (temporary, expires about Nov 12).
Team
Mohammed Soliman
GitHub: @MohammedSoliman10
Email: mohammedsolly4@gmail.com
soilmanboss1
Email: soilmanboss1@gmail.com
Project nature: a two-person hackathon submission for the Modular Cloud & Middleware track. Built with AI assistance (opencode, Spec Kit, Google Antigravity); AI-assisted commits are marked [ai] in the git history.
Judges & Voting Fit
For Judges: deployed contract with live pass and slash on testnet, 6 deals (5 settled, 1 live and healthy until Nov 11), a keyless verifier, a consumer contract, an MCP server, 889 tests, and an open repo. The README and Build page say plainly what is not claimed: a passed challenge proves one random block inside the window, not continuous storage; only the deal owner can challenge; the challenge index is not VRF-grade; one operator and one provider so far; no audit; no customers or revenue yet.
For Community Voters: no wallet needed. Open the status app, go to Verify, check a file against the on-chain deal root, change one byte and watch it fail, then open Replay to see a real 20% slash.