Built at NEAR Hackathon · live on testnet
Patch in time,
or pay the owner.

If the maker misses a security patch deadline, the device's current owner can collect. Sureplate is a security warranty that is its own escrow: the maker's bond is locked inside the device's NFT on NEAR, and it follows the device when it is resold.

connecting…
Loading…

Recent passports

Loading…

How it works

Four rules, all enforced by one contract on NEAR. No insurer, no claims desk.

01
Mint and bondThe maker mints one passport NFT per unit sold and locks NEAR inside it, with the hash of the unit's software bill of materials and its end-of-support date.
02
An advisory starts the clockAnyone can report a vulnerability against the product line by staking NEAR. The maker's promised patch window starts counting down.
03
Patch, or payFix published in time: nothing is owed. Deadline missed: the current holder of the NFT collects a share of the bond, in one click.
04
Resell it, it all movesA normal NFT transfer carries the passport, the remaining bond and the right to collect to the next owner.

What a missed deadline pays

SeverityShare of the unit's bond
Low10%
High25%
Critical50%

If the advisory is wrong

The maker can dispute it once, for a fee equal to the reporter's stake. The clock pauses and the line's arbiter rules. In the demo that is a Sputnik DAO council vote. Upheld: the fee goes to the reporter and the clock restarts. Rejected: the reporter's stake goes to the maker.

When support ends

The maker takes back what is left of the bond, after anything still owed to the owner is paid first. The passport stays with the owner as the unit's permanent record.

What is real, and what is next

Stated plainly, so you know what you are looking at.

Real today

The contract, the bond escrow, the patch clock, the payout to the current NFT holder, resale, disputes through a DAO vote and the end-of-support release all run on NEAR testnet. Every state on this page is read from the chain.

Only demonstrated

Testnet NEAR, a made-up maker, and patch windows of seconds instead of days. No real manufacturer has bonded a product. The contract is not audited.

Next

Advisory verification: check the public vulnerability record against the unit's SBOM inside an attested enclave, so a valid advisory needs no vote. Arbiter trust: a council of CERTs, auditors and insurers with their own stake, instead of three demo accounts. Then a stablecoin bond.

Sign in with a claim-only key

Add an access key to your account that can do one thing: call claim on this contract. It cannot move your NFT or spend your NEAR beyond gas. The page checks that on chain before accepting it, and keeps it in this browser only.