Independent Verification of Two Blockchain Loyalty Prototypes (Short Engagement)

Independent Verification of Two Blockchain Loyalty Prototypes (Short Engagement) Overview We're finalizing a developer selection for a short (3–4 week) build of a stablecoin-based consumer loyalty pilot, and we need an independent engineer to verify two candidate submissions before we award the contract. This is a review-and-report engagement only — you will not be building the pilot, and you must have no affiliation with either candidate. Both candidates have submitted working demonstrations of the same core pipeline. One is a live demo running on a public EVM testnet with real on-chain transactions; the other is a browser-based prototype on simulated data that ships with its own self-verifying test harness. Your job is to independently confirm what each submission actually does, what is real versus simulated, and where the production risk sits — so our decision rests on your verification rather than the candidates' own claims. Technical context The intended production stack is: USDC on Base (EVM), a managed embedded wallet (Privy or Coinbase Embedded Wallets), Shopify orders/paid webhooks, server-side reward issuance, a mobile-web consumer surface, and Digital Ocean hosting. Familiarity with this stack is important for judging how far each demo is from launch-ready. What you'll verify Candidate A — live real-chain testnet demo. Clone the repo and run it end-to-end from the README with fresh credentials, then confirm: On-chain reward issuance actually executes, and the reported transaction hashes resolve on the Base testnet block explorer. Duplicate/replayed order webhooks are rejected idempotently (balance unchanged). Cohort gating works (non-treatment users are rejected). The issuance rate is runtime-configurable and takes effect on the next issuance. Rewards are tracked in a double-entry / append-only ledger rather than a mutable balance field. Candidate B — simulated prototype + self-verifying harness. Run the prototype and its harness independently (headless under Node/jsdom), not the candidate's own recorded pass, and confirm: The SHA-256 of the loaded prototype bytes matches the delivered copy. All assertions pass when the harness drives the real prototype (real clicks, nothing mocked). Append-only ledger, ledger-derived balances (credits minus debits, no mutable balance field), idempotency + authenticated webhook handling, treasury conservation, OTP enforcement on withdraw, no-overdraw with re-auth, CSV export recomputes to match the on-screen values, pause/drain behavior, and input-injection handling all hold up. Both candidates — production-readiness assessment. For each, flag the gap between what's demonstrated and what a real pilot needs: concurrency and persistence under load, key management (KMS), moving from simulated/testnet to a real USDC-on-Base + Shopify deployment, and anything a self-graded or single-author demo could be masking. Deliverables A short written report (per candidate) covering: What you were able to reproduce independently, and how. What is real, what is simulated, and what could not be verified. A reproducibility rating and a plain-language risk assessment. A brief (30-minute) call to walk us through your findings. Required skills Solidity / EVM smart contracts; experience with Base and USDC. Node.js, headless testing (Node/jsdom), reading and running unfamiliar codebases from a README. Embedded/managed wallets (Privy, Coinbase Embedded Wallets) and Shopify webhook integration. Blockchain security or audit background; comfort distinguishing genuine on-chain behavior from simulation. Engagement details Fixed-scope review; estimated 8–15 hours. Written report and findings call within 5 business days of receiving both submissions. NDA required. You must confirm no prior or current relationship with either candidate. Please include, in your proposal: relevant EVM/Base audit or verification work, and a one-line note on how you'd tell a real on-chain transfer from a simulated one.