Privacy-preserving compliance infrastructure for DeFi on Flow.
Users prove compliance with zero-knowledge proofs. Identity never touches the chain.
Live App · Contracts on Flowscan · Docs · Setup · Contributing
DeFi protocols need to verify users are compliant. The current options are bad: add KYC forms and kill the user experience, or skip compliance and get shut down by regulators. There's no middle ground.
FlowShield is the middle ground. One line of Cadence and your protocol is compliant — no identity data on-chain, no KYC forms, no user friction.
import ComplianceAction from 0x93c691a98b975493
access(all) fun deposit(user: Address, amount: UFix64) {
assert(ComplianceAction.verify(user), message: "Compliance required")
// your deposit logic
}- User signs up with a fingerprint (WebAuthn passkey) — no wallet, no seed phrase
- A zero-knowledge proof is generated client-side (circom + snarkjs)
- The proof is verified on FlowEVM via a Solidity Groth16 verifier
- The boolean result crosses back to Cadence through a Cadence-Owned Account
- A
ComplianceCredentialresource is minted into the user's account storage
The blockchain knows the user is compliant. It never knows who they are.
Seven contracts deployed on Flow Testnet at 0x93c691a98b975493:
| Contract | What it does |
|---|---|
ComplianceCredential |
Resource stored in user accounts — credential ownership and expiry |
ZKVerifier |
Validates zero-knowledge proofs from registered verifiers |
ComplianceAction |
Flow Action — composable compliance gate with per-verification fees |
RuleEngine |
Per-jurisdiction compliance rules (US, EU, UK, SG, CA) stored on-chain |
DemoLendingPool |
Reference lending pool with compliance-gated deposit and borrow |
ComplianceAgent |
Autonomous agent that monitors wallets and flags expired credentials |
Governance |
Multi-sig M-of-N proposal system for admin operations |
| Primitive | Usage |
|---|---|
| Actions | ComplianceAction.verify() — composable pre-transaction compliance check |
| Resources | Credentials live in the user's own account storage |
| Agents | ComplianceAgent monitors wallets, emits events for re-verification |
| Scheduled Transactions | Monitoring cycles run on a recurring timer |
| Sponsored Transactions | Protocol pays gas — users pay nothing |
| Passkeys | Biometric login creates a real Flow account in seconds |
Four specialized agents, orchestrated through a Google A2A-style protocol:
| Agent | Type | What it does |
|---|---|---|
| Risk Scoring | Deterministic | 8 rule-based factors from public chain data. No LLM. |
| Anomaly Monitor | Hybrid | Deterministic detection + Claude AI context enrichment |
| Regulatory Radar | Hybrid | Scans on-chain rules against 5 jurisdiction checklists, Claude adds regulatory context |
| Builder Copilot | AI | Claude Sonnet 4.6 — compliance code assistant and integration questions |
Agent discovery: GET /.well-known/agent.json
- Prompt injection guard — all AI agent inputs are sanitized. Injection attempts are classified by severity (block/flag), and high-confidence attacks are rejected before reaching Claude. Zero-width character obfuscation, context object injection, and response leak detection are all covered.
- Context sanitization — only allowlisted keys with type-checked values are passed to AI agents. No raw user input reaches the system prompt.
- Zero PII on-chain — identity data stays off-chain. Only a boolean compliance result and optional risk score are written to the blockchain.
See SECURITY.md for vulnerability reporting.
git clone https://github.com/Wilsawn/flowshield.git && cd flowshield
cp .env.example .env
cp backend/.env.example backend/.env
# Fill in: ANTHROPIC_API_KEY (required for AI agents)
npm install
npm run devFrontend (Vite) runs on http://localhost:5173, API on http://localhost:3002.
| Layer | Technologies |
|---|---|
| Blockchain | Flow Testnet, Cadence 1.0, FCL, FlowEVM |
| Smart Contracts | 7 Cadence + 1 Solidity (Groth16 verifier) |
| ZK Proofs | circom circuits, snarkjs, Groth16 / BN256 pairing |
| Frontend | React 19, Vite, TailwindCSS, Framer Motion |
| Backend | Node.js, Express, A2A protocol |
| AI | Claude Sonnet 4.6 (Copilot) + Haiku 4.5 (agents) with orchestration and chaining |
| Auth | WebAuthn / Passkeys, Google OAuth, Veriff KYC |
| Infrastructure | Supabase, Railway, Netlify |
flowshield/
├── frontend/
│ ├── src/
│ │ ├── components/
│ │ │ ├── docs/ Interactive knowledge graph documentation
│ │ │ ├── dashboard/ Dashboard widgets (stats, charts, actions)
│ │ │ └── ui/ Shared UI primitives
│ │ ├── pages/ Route-level page components
│ │ ├── lib/ API client, Supabase, security utils
│ │ └── utils/ Flow/FCL configuration
│ └── ...
├── backend/
│ ├── agents/ 4 AI + rule-based agents, orchestrator, A2A
│ ├── api/ Express server + 12 route files
│ └── lib/ Auth, crypto, Flow signer, prompt guard, Supabase
├── cadence/
│ ├── contracts/ 7 Cadence smart contracts
│ ├── transactions/ State-changing operations
│ └── scripts/ Read-only queries
├── evm/
│ ├── contracts/ Solidity Groth16 verifier
│ └── circuits/ circom ZK circuit
└── docs/ Documentation ([index](docs/README.md))
See CONTRIBUTING.md for setup and PR guidelines.
Full API documentation is in the Architecture docs. Key endpoints:
GET /health Server status
GET /api/compliance/status/:address On-chain compliance status
GET /api/compliance/rules/:jur Jurisdiction rules
POST /api/risk/score Risk score for any Flow address
POST /api/accounts/create Custodial account creation
POST /api/copilot/chat Builder Copilot (auth required)
POST /api/copilot/radar/scan Regulatory Radar (auth required)
GET /.well-known/agent.json A2A agent discovery
┌─────────────────────────────────────────────┐
│ User Experience │
│ React 19 · Vite · TailwindCSS · Passkeys │
├─────────────────────────────────────────────┤
│ A2A Protocol │
│ Orchestrator · Task Manager · Agent Cards │
├─────────────────────────────────────────────┤
│ AI Agents + Security │
│ Risk · Anomaly · Radar · Copilot │
│ Prompt Guard · Context Sanitization │
├─────────────────────────────────────────────┤
│ Compliance Engine (On-Chain) │
│ 7 Cadence contracts · Fee treasury · Gov │
├─────────────────────────────────────────────┤
│ Zero-Knowledge Verification (Cross-VM) │
│ circom → snarkjs → FlowEVM Groth16 │
└─────────────────────────────────────────────┘
MIT