zk-Attested Ad View

Ad views fund the prize pool. The protocol must therefore prove that ad views actually happened — not merely that a client claimed they happened.

The naive failure mode

A client-side "ad watched" claim is trivially forgeable. A user can replay a "yes I watched" event arbitrarily many times. Without verification, the system pays prize pool against zero real ad revenue.

AdMob SSV as ground truth

Google AdMob's Server-Side Verification (SSV) is the source of truth: when an ad completes, AdMob's server sends a signed callback to a configured endpoint, including the ad ID, user ID, timestamp, and revenue impression metadata. The callback is signed by AdMob with a public-key Google publishes.

Each verified callback is the protocol's authoritative record that one ad was watched. The reward credit for that view is issued only after the callback is received and verified.

The privacy problem

Naive on-chain settlement of SSV would publish each user's ad view history. This is unacceptable because:

• It exposes ad-engagement patterns of identifiable users.
• It exposes monetization metadata (eCPM, advertiser, geography).
• It correlates with user identity in ways that violate user privacy and may breach AdMob ToS.

The zk-SNARK construction

CashPop wraps each AdMob SSV callback in a zk-SNARK that proves:

"I possess a valid AdMob SSV callback for user i, ad j, at timestamp t, signed by AdMob's known public key."

without revealing the contents of the SSV signature itself.

Formally, the prover constructs:

$${\pi }_i=\text{Prove}(\mathrm{\exists }{\text{SSV}}_i:{\text{Verify}}_{p{k}_{AdMob}}({\text{SSV}}_i,\text{ad\_id},{\text{user}}_i,t)=1)$$

The on-chain verifier accepts π_i as evidence of an ad view. The SSV signature itself is destroyed after proof generation.

Implementation

• Prover: SP1 zkVM (Succinct), generating Groth16-wrapped Plonky3 proofs.
• Verifier: a TON smart contract implementing Groth16 verification on BN254.
• Proof size: ~200 bytes per ad view.
• Verification cost: ~0.001 TON per proof.

At scale, ad views aggregate before settlement. A batch of N views generates one aggregate proof (recursive composition), bringing per-view verification cost to ~$0.00001.

Phase 2 status

The zk-SNARK pipeline is targeted for Phase 2 (Q4 2026). Until then, ad view settlement uses a federated multi-signature: AdMob SSV callbacks are received by 3 independent operators, each of whom independently confirms before crediting POP. This provides Byzantine fault tolerance over a small operator set, while the zk pipeline matures.

Why this matters

Ad-fraud markets (click fraud, impression fraud, attribution fraud) cost the ad industry an estimated $80B/year (Juniper Research, 2026). CashPop's structural integrity rests on the inability to inflate ad views. The zk-attestation pipeline puts the protocol in the strongest known integrity position: cryptographic, not policy-based.