ChainVision

Proof-of-concept web app that fingerprints photos and videos with SHA-256, anchors hash + metadata (never the file) on the XRP Ledger Testnet, and verifies integrity later for a trust layer against tampering and synthetic media.

Architecture

Layer	Stack
Frontend	Next.js 16 (App Router), React, Tailwind CSS
Backend	FastAPI, xrpl-py, SQLite registry
Ledger	XRPL Testnet JSON-RPC

Quick start

1. Backend

cd ChainVision
python3 -m venv .venv
source .venv/bin/activate
pip install -r backend/requirements.txt
cp backend/.env.example backend/.env
# Edit backend/.env: XRPL_JSON_RPC_URL, XRPL_WALLET_SEED, XRPL_PAYMENT_DESTINATION
cd backend
uvicorn main:app --reload --host 127.0.0.1 --port 8000

The app loads variables from backend/.env automatically (python-dotenv). Restart the server after changing .env.

# (optional) confirm XRPL env is visible to the API
curl -s http://127.0.0.1:8000/health

XRPL configuration

• XRPL_JSON_RPC_URL: HTTPS JSON-RPC URL for XRPL Testnet (any compatible rippled endpoint).
• XRPL_WALLET_SEED: Testnet wallet seed used to sign anchoring transactions.
• XRPL_PAYMENT_DESTINATION: A different classic address than the wallet above. XRP payments cannot send to self; fund both addresses from the XRPL Testnet faucet.

Anchoring uses a small XRP payment with a memo containing JSON: integrity_hash, registered_at, device_id, and a fixed SourceTag (XRPL_SOURCE_TAG, default 2026040040) for sender-side attribution on-ledger.

2. Frontend

cd frontend
cp .env.example .env.local
npm install
npm run dev

Open http://localhost:3000. Set NEXT_PUBLIC_API_URL if the API is not at http://127.0.0.1:8000.

API

Method	Path	Description
POST	/api/upload	Upload media; returns SHA-256 of raw bytes, commitment hash (file + metadata). Form fields: device_id, optional device_username, device_name (bound into the commitment / memo JSON).
POST	/api/register	JSON body: integrity_hash, registered_at, device_id, device_username, device_name (same values as upload). No file. Persists + memo tx on XRPL Testnet; returns XRPL transaction hash.
POST	/api/verify	Recompute file hash; match local registry or account memos on-ledger. (Optional reference_hash for API clients: compared to the file hash first.)
GET	/api/records	Debug: list stored registrations.
GET	/health	Liveness and whether XRPL env is set.

Verification outcomes

• Authentic Media — Integrity hash found in the local registry or in memos for the configured account on the ledger.
• Not Register on XRPL — No matching registration on the ledger (or local registry).
• Tampered Media — Only when reference_hash is supplied via the API and does not match the recomputed file hash.

License

See LICENSE.