# Sponsor bounties: what Orb can evidence

Orb enters **Track 03, Social, Attention & Culture**, and nothing else is needed to compete for the track
prizes. Sponsor bounties are a separate, optional choice, scored 40% on adherence to the sponsor's published
requirements, 30% on technical implementation, 20% on Monad integration and 10% on innovation. The terms
(§8.2, §10) make a false claim of eligibility a serious matter, so this page lists only what the repository can
show, and each bounty is selected on the dashboard only after its published requirement has been read and
met literally.

The sponsor list on the official hackathon page can change and may be incomplete: the dashboard decides. The
requirement text is not in this repository; the column "To confirm" is what is still open for each one.

## Candidates, with what exists

| Bounty | What the repository shows | To confirm on the dashboard |
| --- | --- | --- |
| Privy | Embedded Orb Wallet and login (`components/orb-providers.tsx`, `components/orb-wallet-connect.tsx`, `lib/privy-wallet.ts`). Server-side verification of the Privy access token before any wallet-scoped action (`lib/orb-wallet-server.ts`). Reviewed actions signed by the embedded wallet without a second popup (`lib/orb-wallet-transaction.ts`). The wallet signs the Open Ledger consent (`components/orb-ledger-panel.tsx`) and binds an NFT avatar to the profile (`app/api/profile/nft-avatar/route.ts`). Tests: `scripts/test-orb-wallet-client.mjs`, `test-orb-wallet-transaction.mjs`, `test-nft-profile-binding.mjs`, `test-wallet-role.mjs`. | **Requirement read on the dashboard, October 12:** Privy must be integrated *beyond authentication*; login-only does not qualify; the demo must clearly show the Privy-powered functionality; a ≤2 min video is **optional**; bonus for several Privy features. Met in code (see the Privy answer below). **Not yet met on camera:** no real Privy login or Privy-signed transaction has been recorded, and the live host's Privy configuration has not been verified since the app secret was disclosed. |
| Perpl, Best Use of Perpl's API | Perpetuals through Perpl on testnet: `lib/perpl-client.ts`, `perpl-auth.ts`, `perpl-vault.ts`, `perpl-order-progress.ts`, the desk in `components/orb-perp-desk.tsx`, and an assistant that prepares tickets the user reviews (`lib/trade-assistant.ts`). Tests: `scripts/test-perp-entry.mjs`, `test-perpl-security.mjs`, `test-perpl-session.mjs`, `test-perpl-order-progress.mjs`, `test-perpl-market.mjs`. | **Requirement read on the dashboard, October 12:** a ≤2 min video showing a trading bot or automation system on Perpl *with demonstrated real on-chain activity*. Orb's automation is deliberately alert-only and no order has been placed on testnet, so this is **not met today**: either a real testnet order is put on camera, or the bounty is dropped. |
| Perpl, Best Analytics / Risk Tool | Position planner, price alerts that cannot trade (`components/orb-alerts.tsx`, `lib/trade-alerts.ts`, `app/api/orb/alerts/route.ts`) and the assistant's market reading. Tests: `scripts/test-orb-alerts.mjs`, `test-trade-assistant.mjs`. | Whether the requirement is about analytics and risk in the sense these features cover. Select only if it is. |
| Kuru, Consumer Trading App | Spot trading through Kuru (`lib/kuru-spot.ts`, `components/orb-kuru-spot.tsx`), verified swap receipts that can be shared into the feed (`lib/spot-receipt.ts`, `components/orb-spot-receipt-card.tsx`) and checked on `/proofs`. Tests: `scripts/test-kuru-spot-security.mjs`, `test-shared-market-card.mjs`, `test-trade-card-api.mjs`. | The requirement. **A real testnet swap and its transaction hash are needed as evidence.** |
| Monad Foundation, Best Community Team Project | Not assessed: the name does not say what is asked. | The whole requirement. |

## Not selected, and why

- **Mera (two bounties)**: no passkey sign-in was built. Mera is a preview library and a passkey is bound to the
  site it was created for, which does not suit a client meant to be copied to any host.
- **Alibaba Cloud (Qwen), Kimi, Kepler Plan by Tencent (Hunyuan)**: the assistant runs the router model
  `openrouter/free` (`lib/hunyuan.ts`; the file name is historical). No Qwen, Kimi or Hunyuan model is pinned, so
  selecting these would claim an integration that does not exist. The README discloses that Qwen was used as a
  coding assistant, which is a different thing.
- **Agora, Dynamic, Nansen, Aurora Intents, Chainlink, Cleanverse, MetaMask Agent Wallet Plugin, Envio,
  Alchemy, Kuru "Bring New Assets and Markets"**: there is no integration with any of them in the code.

## Privy: the answer for "describe how your project meaningfully integrates Privy"

Privy is not how a member gets into Orb. It is how Orb decides what a member may do with a wallet, and how that wallet actually signs. Four distinct
uses, all in this repository:

1. **Privy's embedded wallet signs the community's most important message.** When an owner turns the Open Ledger on, the consent text is signed by the
   member's Privy embedded wallet (`components/orb-ledger-panel.tsx`: `useWallets()` → `wallet.getEthereumProvider()` → `signer.signMessage(ledgerOpenMessage(...))`,
   and the same for closing a ledger). The contract rebuilds the readable consent itself and checks the signature against it, so the Privy wallet binds
   the owner to exactly the text the chain shows — not to a string the server claims was shown.
2. **Privy's embedded wallet sends the transactions.** Orb's own wallet actions go out through Privy's react-auth transaction hook
   (`components/use-orb-sender.ts`: `useSendTransaction()`, `chainId: 10143`), which is the single sender behind ORB transfers, mission funding and
   approval, opt-in tips, Holder Pro locks and the Arena's on-chain moves (`components/orb-arena-chain.tsx`, `components/orb-community-arena.tsx`,
   `components/orb-community-portability.tsx`, `components/orb-assistant-trade-ticket.tsx`). A rejected signature is treated as a cancellation, not
   retried. This is the product rule the rest of the app is built on: nothing leaves Orb's browser without the member's own wallet signing it, and
   Privy is where that key lives.
3. **Privy is the server's authorization layer, not just its login.** Every wallet-scoped request is refused before it touches a contract unless the
   request's Privy access token verifies (`PrivyClient.utils().auth().verifyAccessToken`) **and** the Privy user behind it lists that address among its
   linked accounts (`lib/privy-wallet.ts:5-16`). The same check protects the profile: an NFT avatar can only be set by the Privy account whose linked
   wallet holds it, and a valid token from a different Privy account cannot move another profile's spending wallet (`lib/privy-wallet.ts:20-29`,
   `app/api/profile/nft-avatar/route.ts`). An `address` field in a request body is never trusted on its own.
4. **The wallet survives leaving the app.** A member who moved to the static independent client recovers the *same* embedded wallet through Privy there
   (`components/orb-independent-login.tsx`, and `public/independent/wallet-login.js`, which bundles Privy's react-auth and offers "Recover Orb Wallet
   with Privy"; a browser wallet is the fallback). The encrypted archive a member recovers is bound to that wallet, so the Privy session is what ties a
   person to material Orb's server cannot read.

**What to say plainly about it:** the login path and these signatures are covered by tests that simulate a Privy session
(`scripts/test-orb-wallet-client.mjs`, `test-orb-wallet-transaction.mjs`, `test-wallet-role.mjs`, `test-nft-profile-binding.mjs`); a real Privy account
has not been driven end to end on the public host yet. The ≤2 minute Privy video this bounty asks for is optional, and it should show one real flow —
sign in, turn on a public ledger and sign the consent, then send ORB from the wallet — rather than describe it.

## Before selecting any bounty

1. Read its published requirement on the dashboard and tick it off line by line.
2. Add the file, the endpoint and, where the requirement asks for on-chain activity, the transaction hash.
3. Say in the video which bounty a scene is evidence for, and keep the scene to what the requirement asks.