1. Overview & Ecosystem Position

SOVA Protocol operates as the verifiable reputation layer for Whitechain L2. While WhiteBIT and WB Soul provide the foundation for identity verification (Who is this user?), SOVA evaluates onchain behavior (How has this identity performed?) and publishes machine-readable scores directly onto Whitechain Sepolia.

2. Trust Boundaries & Isolated Signing (Phase 1.3)

To protect attestation integrity, the pilot architecture strictly separates three processes so that private keys are never exposed to untrusted environments or request files:

3. Onchain Smart Contracts (Whitechain Sepolia)

The protocol is governed by three primary smart contracts deployed and verified on Whitechain Sepolia (Chain ID 1874/1875):

4. Privacy & Salted Cryptographic Attestations

Raw transaction logs, individual loan balances, and sensitive financial metrics remain 100% offchain in local SQLite indexes. Only salted cryptographic commitment hashes are written onchain:

// Commitment Formula
bytes32 commitment = keccak256(
    abi.encodePacked(soulId, rawMetricsHash, salt, nonce)
);

// Onchain Verification
function verifyAttestation(
    uint256 soulId, 
    bytes32 rawMetricsHash, 
    bytes32 salt
) external view returns (bool) {
    return registry.commitments(soulId) == keccak256(abi.encodePacked(soulId, rawMetricsHash, salt));
}

5. Persistent Indexer & Query Service (Phase 1.2)

The Node.js indexer syncs registry logs into a local SQLite database (`indexer-data/whitechain-sepolia.sqlite`). Each sync automatically rewinds 20 blocks to purge reorganized events, fetches in 5,000-block chunks, and transactionally rebuilds projections.

6. Observability & Rate Limiting Controls (Phase 1.5)

• X-Request-Id: Traced on every API request; request bodies & salts are never logged.
• Health Endpoint (/health): Returns HTTP 503 if indexer lag exceeds `SOVA_MAX_INDEX_LAG_BLOCKS` or SQLite integrity check fails.
• Rate Limiting (/v1/*): 60 requests per minute per socket connection, returning HTTP 429 Retry-After.
• Metrics (/metrics): Exposes Prometheus-formatted counters for confirmed index lag without exposing subject addresses.