Skip to content
Watermark
Menu
Back to the home page
Bot test · Real requests on testnet

Bot army vs. Watermark.

Making wallets is free, so bots make thousands. Press the button. We make 5 wallets with no card. Each asks for test USDT, a free payment and a Genesis Drop NFT. These are real requests. Nothing here is faked.

A bot farm

Illustration. Every wallet looks the same until one has a stamp.

Wallets are free to make. Bank cards are not.

Watch bots try.

Keys are made in this browser, kept in memory and thrown away on reload. Wait a minute between runs.

Press Launch and the bots appear here, one row each.

  • Refused means the guard worked.
  • Got through means a bug. Its cell turns white.

A wallet with a real bank card gets through.

See the payment (opens in a new tab)

Every door has a guard.

Every free thing checks for a stamp first. No card, no stamp, no entry.

  1. Our server

    Live

    Checks for a stamp before it sends anything. The bots above meet this guard.

  2. The payment contract

    Tested in code

    Says no to a wallet with no stamp, even if someone skips our server.

  3. The NFT contract

    Tested in code

    Won't mint a Genesis Drop NFT to a wallet with no stamp.

  4. Ethereum test network

    Tested in code

    The app that pays fees there checks for a stamp too. See a stamped wallet get in (opens in a new tab)

    The refusal is tested in code. It isn't shown on the network yet.

  5. Same card, second wallet

    Tested in code

    One card can't stamp a second wallet in the same app.

    Not tried live yet.

Details for builders

Each bot is a fresh key made in this browser (viem generatePrivateKey). It calls the relayer: POST /fund, then POST /pay with a real EIP-3009 signature for 1 USDT to the demo shop, then POST /pass. The key signs one authorization and is dropped. Nothing is stored or logged.

403 NOT_STAMPED shows as Refused. The relayer allows 10 /fund and 10 /pay calls, and 5 /pass calls, a minute per IP. More gets 429 RATE_LIMIT, shown as "Slowed down". Any 2xx shows as a bug, with its transaction. Any other code is shown as it is and isn't counted as a refusal.

The Sponsor contract reverts NotStamped even if someone skips the relayer. The Genesis Drop NFT's mint reverts NotStamped. The alt-mempool paymaster refuses unstamped senders in its VERIFY frame (test_unstampedSender); a stamped wallet's frame tx was admitted (opens in a new tab), and an on-chain refusal is planned. A second wallet for the same card reverts NullifierBoundToOtherWallet in the registry; the phone then shows a general ‘chain refused the stamp’ message. These are Foundry tests; that last one is untested live.