A zero-knowledge proof attendance system that protects user identity.

The system builds a membership set from registered attendees and generates a Merkle Tree through hash computation. A user's identity credentials are not directly exposed to the verifier — they participate in proof generation as private inputs.

During check-in, the user submits a Proof, not plaintext identity fields. The verifier only needs to check whether this Proof is valid and whether the corresponding Nullifier has already been used.

If the Proof is valid, it means the user does belong to the legitimate registration set. If the Nullifier hasn't appeared before, it means this is not a duplicate submission. Throughout the entire process, the verifier has no direct access to the user's UserID, CheckinSecret, or other private inputs.

The core mechanism isn't about hiding everything — it's about minimizing unnecessary information exposure during verification. It converts "who are you" into "do you satisfy a certain condition." This is where zero-knowledge proofs are most valuable in identity authentication scenarios.

The project is primarily a prototype system targeting event check-in scenarios, including modules for user registration, event session management, membership set construction, Merkle Root generation, Proof generation, Proof verification, Nullifier anti-replay detection, and check-in result management.

The backend is responsible for managing events, users, sessions, and check-in status. The proof-related component generates verifiable proofs based on user private inputs and public parameters. The verification logic determines whether a Proof is valid and records used Nullifiers to prevent the same identity credential from being reused.

In terms of engineering, the focus is on whether the mechanism closes completely — not on piling on features. The project's emphasis is not on building a feature-rich event management platform, but on taking a clear problem from theoretical mechanism to a working system: how to introduce privacy-preserving identity verification into a check-in scenario.

This project made me realize that the real difficulty in security systems is not just "knowing the algorithm" — it's "how to put the algorithm into a real process."

In papers and references, zero-knowledge proofs are often described as an elegant mechanism. But in actual engineering, you need to consider: how the proof input is generated, how public parameters are managed, how the Root is synchronized, how Nullifiers are stored, how edge cases are handled, how verification failures are reported, and how the system avoids re-leaking privacy through other channels.

I also came to understand that an undergraduate thesis doesn't need to disguise itself as cutting-edge research. What it should demonstrate is: can you identify a specific problem, choose an appropriate technical path, complete the system design and implementation, and then test and explain the results within clear boundaries.

For me, this project was an exercise in transforming information security expertise into a concrete system. The value lies not in theoretical depth, but in the complete experience of embedding a security mechanism into a real business process.

This is an undergraduate graduation project — it is closer to a working engineering prototype than a production-grade privacy authentication platform. It doesn't attempt to solve all complex scenarios, nor does it overextend into large-scale concurrency, cross-organizational identity federation, on-chain verification, or trusted hardware integration.

The focus is clear and bounded: within an event registration and check-in scenario, verify that a user belongs to a legitimate set, avoid directly exposing raw identity fields during verification, and prevent duplicate check-ins through Nullifiers.

I believe this kind of boundary is necessary. For an undergraduate project, clearly explaining a problem, getting the core mechanism working, and completing thorough security testing is far more valuable than piling on impressive but inconsistent concepts.

The project has completed the main implementation of the graduation thesis phase, including core business process, proof generation and verification flow, database design, security testing, and thesis writing.

If continued, future extensions would focus on three directions: optimizing the proof generation and verification experience, improving the system UI and event management workflow, and exploring its use in more identity authentication scenarios.

It is currently not a commercial product or mature platform, but an undergraduate engineering project completed around a privacy-preserving check-in mechanism. Its value lies in validating an idea: in some identity authentication scenarios, we don't necessarily have to expose "who I am" — we can simply prove "I have the qualification."