What we compute. What we can't prove.

Daily precipitation_sum comes from the Open-Meteo archive API with models=era5 pinned: the ECMWF ERA5 reanalysis on a 0.25° grid (≈ 28 km). The request point 4.88° N, 38.08° E resolves to the cell at 5° N, 38° E (1891 m). Days follow Africa/Addis_Ababa.

Three regional replays use the same method at their own ERA5 cells, with days in their local timezone: Marsabit, Kenya (OND 2021, 1991–2020 normal), Petrolina, Brazil (MAM 2012) and Beed, India (JJAS 2015). The last two use the 1981–2010 normal, because a season may not sit inside its own baseline. The baseline is part of the hashed spec, so it is fixed before any money moves.

The default best_match model is never used: it switches to a different model from 2017, which would mix two series inside one baseline. Raw responses for the demo seasons are committed byte-for-byte with SHA-256 hashes, so the site still works if the API is down — and says so when it falls back.

Cross-check: CHIRPS v3.0 final, 3-monthly, 0.05°. Shown for context only; it never feeds the rule, the index, the hash or the contract.

Each daily value (0.1 mm steps) becomes an integer number of tenths of a millimetre (dmm). T is the season total, S the sum of the same season over 1991–2020, and N the number of baseline seasons (30).

indexBps = floor(T × 10000 × N / S)

For OND 2021: floor(787 × 10000 × 30 / 70193) = 3363 bps, i.e. 33.63 % of a 234.0 mm normal. Integer arithmetic only; any missing or null day makes the evidence INVALID. Nothing is gap-filled.

A campaign is triggered when indexBps ≤ 6000 (60 % of normal). 60 % of normal is an illustrative hackathon rule, not an official drought definition.

Base rate: in ERA5 at this cell, 7 of 30 baseline seasons fall at or below it — roughly one year in four. A real programme would calibrate a threshold (for example with SPI on a fitted distribution) with the people it is meant to serve.

The campaign spec (location, source, model, period, baseline, threshold, replay flag) is serialised with RFC 8785 canonical JSON and hashed with keccak256. The contract stores that hash before any money is locked.

The evidence core holds the spec, the resolved grid cell, all observed daily values, every baseline season total and the result. Its keccak256 over canonical JSON is the evidence hash. Because it excludes retrieval timestamps, anyone re-fetching the same public data gets the same hash.

A matching hash proves integrity and reproducibility — not that the rainfall estimate is correct.

The attestor signs typed data, so wallets show named fields instead of an opaque blob. The type is defined once and shared byte-for-byte with the contract:

Attestation(uint256 campaignId,bytes32 specHash,bytes32 evidenceHash,uint32 indexBps,uint32 observationStart,uint32 observationEnd,uint64 expiresAt)

The domain binds it to this contract and chain. There is no nonce: each attestation already names one campaign and one spec, and a campaign can only settle once. An expiry limits how long a signature stays usable.

RilvaEscrow is ownerless and non-upgradeable. settle checks, in order: the campaign exists and is active, the window is open, the attestation has not expired, the spec hash and period match, and the signature recovers to the designated attestor. Only then does it compare the index with the threshold itself and send the fixed amount, once, to the fixed beneficiary or back to the funder.

If nobody settles before the deadline, anyone can trigger a refund to the funder. Rejected attempts revert with a named error, which the campaign page demonstrates with no-gas simulations. The contract has an extensive test suite but no professional audit.

The attestor is trusted to sign honestly; Rilva makes every attestation checkable, not automatically true. A dishonest attestor could sign a false index. Anyone can detect it — the evidence hash will not reproduce — but the contract cannot prevent it, and whichever valid attestation arrives first is final.

Recomputing in the browser lets the attestor and the public check the number; it does not remove that trust. Future work: several independent attestors, or a challenge window.

• • Replay, not monitoring. Every season shown is a retrospective replay. Rilva issues no drought alerts.
• • A model, not a gauge. Rainfall estimate from ERA5 reanalysis (a model, not a rain gauge) for one ~28 km grid cell. It does not measure drought impact or financial loss.
• • Sources disagree. ERA5 and CHIRPS v3 disagree for some seasons (e.g. MAM 2021: 55 % vs 101 % of normal). Rilva shows both and uses ERA5 for the rule.
• • Rainfall deficit ≠ loss. The index ignores temperature, soil moisture, pasture, livestock, markets and conflict.
• • Testnet only. No real funds, no insurance, no relief delivered.