ETHOnline 2026 · live on Hedera testnet
From 2027, Europe requires used cooking oil to carry a documented chain of custody starting at collection. Collection is the fryer. Ours is signed twice, weighed at the plant, and audited at random.
And is paid, instantly
$0.248 per litre, the contract’s live rate · two signatures required
The fraud
This is not a hypothetical inefficiency waiting for a blockchain. It is a live, documented fraud that has already broken the certificate system built to stop it.
80%
of the used cooking oil Europe burns is imported, about 60% of it from China. The chain of custody starts outside EU jurisdiction.
Transport & Environment, Dec 2023 ↗
1.8 Mt
of fraudulent ISCC-certified POME entered the EU in 2023 — certified waste that was never waste.
Maritime Executive ↗
2 Mt
of POME-oil biofuel reached the EU in 2023 — against an estimated 1 Mt available worldwide.
T&E — Palm oil in disguise? ↗
2.5 yr
proposed suspension of ISCC recognition for waste-based biofuels, tabled before the European Commission.
QC Intel ↗
Live on Hedera testnet
Not a prototype of the idea. A deployed contract whose runtime bytecode matches the committed source, with the enforcement path exercised end to end — including the parts where it refuses us.
A restaurant is paid without ever transacting
Balance 0 → $4.96 for 20 L, in the same transaction that recorded the pickup. The restaurant signed typed data and sent nothing.
The audit sample really is unpredictable
Seed 0xa5df6581…b387df, drawn from Hedera's PRNG at 0x169 after the lot sealed. A second lot drew a different one.
Mass balance is arithmetic, not a promise
20 L attested against an 18 L plant receipt. Tolerance allowed 18. The 2 L gap cost the collector 0.496 USDC, taken from the bond.
An unanswered audit costs the whole bond
A sampled batch went unconfirmed past the challenge window. The collector's deposit went 499.504 → 0.
A restaurant's signature stops the slash
A second batch was sampled and confirmed by its restaurant. Flagging it then reverted AlreadyConfirmed and the bond stayed whole.
The truck share refuses unapproved holders
An ERC-3643 transfer to a wallet that is not on the allow list reverts with AccountIsBlocked. Compliance that has already said no.
Deployed
Turmoil.sol
0.0.10448308 ↗
attestation, mass balance, audit
TURMOIL UNIT 001
0.0.10452566 ↗
ERC-3643 truck share, 4,000 issued
Settlement
0.0.10448306 ↗
6-decimal USDC stand-in
Circle’s testnet faucet reports success and delivers nothing on Hedera, and no DEX there carries their USDC — so the demo settles against a stand-in with the same six decimals. payToken is immutable and token-agnostic; binding the real one is a config change, and an earlier deployment ran on it.
What we cannot do
We cannot chemically distinguish palm oil from used cooking oil.
Neither can ISCC. That is precisely why the fraud works, and any project claiming otherwise is selling you something. What we change is the shape of the lie: we make the origin claim two-sided and mass-balanced, so faking it at scale means fabricating thousands of restaurant counterparties who each sign independently, with their own key, at their own address, on their own schedule.
That is a different order of difficulty than buying a certificate.
Mechanism
So we do not try. Every layer below exists to make lying unprofitable and detectable, rather than to make it impossible — because impossible is a claim no honest system can make about the physical world.
L1
Dual attestation
live on testnetA batch exists only if the restaurant and the collector both sign it. The owner signs by scanning a QR on the driver's phone, so physical co-presence is implied by the scan itself.
Kills unilateral fabrication.
L2
Conservation law
live on testnetThe plant signs for the weight it actually received. The contract enforces Σ(attestations) ≤ receipt + tolerance. A skimming driver produces an arithmetic gap.
A bill of lading, on chain.
L3
Revenue-gated payout
on chain, paid by handTruck-token holders are paid only out of stablecoin the system actually received. Inflating volume cannot manufacture a distribution. One dividend has been declared on chain and paid by hand; the gating itself is not automated.
Inflation stops paying.
L4
Anomaly flagging
designed, not builtA thin agent reads events and flags what does not fit: a restaurant at 3× its own eight-week average, a route whose volume never closes, one driver's gap trending. A risk scorer, not an oracle.
Enforcement stays in the mechanism, not in a model's judgment.
L5
Random audit, extrapolated slashing
live on testnetWhen a lot seals, the contract calls Hedera's PRNG at 0x169 and samples 30% of the batches — after sealing, so nobody knows which. A sampled restaurant confirms with its own signature. A failure burns the collector's bond.
This is how customs auditing works.
The arithmetic
A deterrent that has not been multiplied out is a slogan. Hypergeometric, sampling without replacement, expressed as a fraction of lot value — with a 50% bond at a 30% sample rate.
| Batches | Sampled | Fabricated | P(caught) | Expected value |
|---|---|---|---|---|
| 100 | 30 | 5% | 83.9% | −36.96% |
| 10 | 3 | 10% | 30.0% | −5.00% |
| 4 | 3 | 25% | 75.0% | −12.50% |
Where it stops working
As fabrication approaches the size of the bond — around 50% — expected value turns non-negative. The theft outruns the slash. We would rather you heard that from us.
Which is why there are two
That range is exactly where the mass balance bites, and it is deterministic — no sampling, no probability. Two mechanisms for two fraud sizes. Neither is sufficient alone, and we do not pretend either is.
The other half
Collection needs capital before it earns anything — a van, a pump, a route. That is ordinary asset finance, and dressing it up as a utility token would only make it an unregistered security. So the share is issued as ERC-3643 through Hedera's Asset Tokenization Studio, carrying the transfer restrictions a security actually has.
TURMOIL UNIT 001 · TRUCK1
It has already refused someone
At creation the allow list held nobody — getControlListCount() was 0 — and the issuer’s own redeem was refused by their own token. After approval it succeeds. A transfer to an unapproved wallet still reverts AccountIsBlocked.
What is not wired
identityRegistry() and compliance() both read 0x0. Hedera publishes no deployed identity-registry or compliance infrastructure for testnet, and pointing them at an address that does not exist would be worse than leaving them unset. The restrictions above come from the studio’s own allow list, internal KYC and registered issuer instead — all three live, all three exercised. Both fields have setters, so wiring them is configuration, not a redeploy.
A dividend has now run: 400 shares transferred to a KYC’d holder, setDividend recorded on chain, and the entitlement read back at the record date. The payment itself was a manual USDC transfer. Automated pro-rata distribution is the studio’s Mass Payout service, which we did not deploy, so that half stays designed, not built.
Built on
Hedera
Native PRNG at 0x169 for the audit draw — no oracle, no VRF wait. Trucks issued as ERC-3643 through Asset Tokenization Studio, because a share of an operating asset is a security.
Built on
Privy
Email login, embedded wallet, EIP-712 signature. No HBAR, no transaction, no install. The collector relays and pays the gas, since the collector earns the margin.
Not a certificate. Not an attestation of an attestation. A receipt with two signatures on it, and a bond that burns if either one was a lie.
Open a live lot receipt