aHand

aHand is a success-only coordination protocol for finding help beyond your immediate social circle. A Raiser locks a USDC reward and shares a capability link or QR code — with a friend, a group chat, or the public board. Each Shaker passes a freshly delegated link onward and may reserve a transparent margin from the same reward. The eventual Giver supplies the solution; when the Raiser says Thank, the contract pays the Giver's remainder, every agreed Shaker margin on the winning route, and a mandatory charity share (1–30%, chosen by the Raiser). If nobody solves the Hand before expiry, the Raiser reclaims the full escrow — nobody earns anything from failure.

This turns word of mouth, six degrees of separation, and pay-it-forward into an open primitive. A human, app, or agent can join at any hop without a privileged protocol role, an appId, or a platform account. Public, Preview, and Dark postures control what is discoverable, while signed capability chains preserve route authority as the link travels through any channel. Settlement leaves a soulbound record — Raised, Shaken, Given, and Thanked receipts plus charity-backed Up — that any application can interpret to build its own history, scores, or reputation without a canonical global number.

We wrote AHandCore, AHandSignals, and AHandWitness in Solidity 0.8.35 with Foundry and deployed to Base Sepolia with Circle's test USDC. Core does exact balance-delta escrow accounting, EIP-712 route verification (EOA and ERC-1271), telescoping basis-point claims across up to six hops, three Shaker consent modes (anonymous zero-margin, self-attributed, or explicit co-signed acceptance), success-only charity, and permissionless expiry reclaim. Thank performs verification, accounting, and storage only; payouts are pushed with a bounded gas stipend and fall back to fixed-destination pull claims if a transfer fails, so no recipient can block settlement. Signals is fully isolated from money: it permissionlessly and idempotently materializes committed outcomes into non-transferable receipts and cumulative-square-root Up (received Up can never be re-spent), with metadata served as fully on-chain SVG data URIs. 197 Foundry tests cover conservation, attack, and invariant fuzzing.

Our TypeScript/viem SDK generates, signs, compactly serializes, and fail-closed verifies complete capability routes: EIP-2098 signatures keep links under 1,900 characters (QR-friendly) and are expanded before Core verification; every hop delegates a fresh capability carried only in the URL fragment, so bearer secrets never reach a server; terminal Give proofs contain no secret at all. Signature vectors are generated by the Foundry suite and replayed byte-for-byte in vitest to pin cross-language EIP-712 agreement. The React/TanStack Start client ties Raise, Pass, Give, Thank, and Reclaim together with Privy social login, wagmi, and permissionless.js smart accounts (EIP-7702 Simple7702Account, EntryPoint v0.8, Pimlico bundler/paymaster for sponsored ops). Discovery docs are pinned to IPFS behind a server-held key and verified byte-for-byte against the on-chain commitment; signed Gives are delivered to the Raiser directly over XMTP with the link as fallback; a Graph subgraph indexes Core on Base Sepolia.