🗄️ Waldrive

Your files. Encrypted. Yours.

A decentralized Google Drive - files are encrypted in your browser, stored on Walrus, and access is enforced on-chain with Sui + SEAL. No platform can read them, ban you, or hold your data hostage.

waldrive.xyz · app.waldrive.xyz · Pitch deck

Built for Sui Overflow 2026

👩‍⚖️ For Judges - start here

Everything you need to verify Waldrive is real and on-chain, in one place. All objects are on Sui Testnet (chain-id 4c78adac).

🔗 Live

What	Link
The app (drive)	https://app.waldrive.xyz
Landing	https://waldrive.xyz
Pitch deck	https://waldrive.xyz/pitch.html

⛓️ Deployed Sui IDs

Object	ID	Explorer
Package	`0xc3a3389720db4251efd1551463ef4dd7b2b78904179f97c618ee1e2cef21c70d`	view
SystemConfig (shared)	`0xa03b958a4f32727ba8749ca1368813eed1efc4a42bedf5620437896ef88b9d5f`	view
AdminCap	`0x061e18442972b294958c49bead7272cc17bb1436be74970d251f6c9eaf708bd8`	view
UpgradeCap	`0x82dc06723e2c7a7529f726c23314f3f11dd72b80af2a4e2184bdd7c617f1ca36`	view
Tier: Pro (shared)	`0xe9e962edfc178eea98d90dc777148f217c0083f5755d508444a32fb470e89ad5`	view
Tier: Max (shared)	`0xe93d6ad46d182d0d0e3ac91cd23f279e49fe2f1cadf82037a061ce0cbdd847ce`	view

Fresh testnet publish. See waldrive/Published.toml for the publish record (package id + upgrade cap).

🎨 Display V2 (`sui::display_registry`) - registered & shared

Each object renders rich metadata + a dynamic image (/api/og/<type>/{id}). All four Display<T> objects are shared on-chain:

Type	Display object
FileObject	`0x518e34f9…ea16398f`
Collection	`0x43f19778…0155fcb6`
ShareLink	`0xf689ee44…0c574ddf`
UserSubscription	`0xb776c31e…fbf29d5f`

🔐 SEAL - where & how it's used

Threshold identity-based encryption; decryption gated by an on-chain seal_approve.

Encrypt (browser): waldrive_fe/src/lib/seal/encrypt.ts - random per-file identity, never sends plaintext.
Decrypt (browser): waldrive_fe/src/lib/seal/decrypt.ts - builds the seal_approve PTB, one SessionKey.
On-chain gate: access_control.move seal_approve(id, &AccessPolicy) - decryption is gated on a shared owner/share policy (shared objects work with SEAL's sender-less approve PTB). The master policy + the FileObject are created in one transaction, so uploading stays a single signature.
Key servers (testnet, threshold 2): 0x73d05d62…db75, 0xf5d14a81…623c8 - see seal/config.ts.

🐋 Walrus - where & how it's used

Erasure-coded blob storage for the encrypted bytes. Waldrive runs its own Walrus node (publisher + aggregator) on Sui testnet at walrus.waldrive.xyz, fronted by nginx.

Client: waldrive_fe/src/lib/walrus.ts
Aggregator (public reads): https://walrus.waldrive.xyz/aggregator - the browser downloads encrypted blobs directly (CORS-enabled).
Publisher (JWT-protected writes): https://walrus.waldrive.xyz/publisher - never hit from the browser.
Upload proxy: waldrive_fe/src/app/api/walrus/route.ts - a same-origin Next route mints a short-lived HS256 JWT (exp 5m, random jti, max_size bound to the body) signed with WALRUS_JWT_SECRET, then forwards the upload to the publisher. The HMAC secret never reaches the browser.
Storage duration is chosen per upload (epochs) - pay for what you need.

🧠 MemWal (Walrus Memory) - AI agent memory

The AI agent's long-term memory: per-user, encrypted on Walrus, owned on-chain.

Server module: waldrive_fe/src/lib/ai/memory.ts - recall / remember, namespace waldrive-{wallet}.
Used by: the agent route waldrive_fe/src/app/api/ai/route.ts and the Agent memory page.
Relayer (staging/testnet): https://relayer-staging.memory.walrus.xyz. Multi-tenant pattern: one operator account + delegate key (server-side only).

🗺️ Architecture at a glance

flowchart LR
    subgraph device["Your device"]
        B["Browser<br/>wallet · zkLogin<br/>SEAL encrypt / decrypt"]
        AG["AI agent<br/>plan → confirm"]
    end

    PX["/api/walrus<br/>mints JWT"]
    PUB["Walrus publisher<br/>our node · fronts WAL cost"]
    SUI[("Sui<br/>FileObject · AccessPolicy<br/>subscription")]
    WAL[("Walrus<br/>encrypted blobs")]
    SEAL["SEAL key servers"]
    MEM[("MemWal<br/>encrypted agent memory")]

    B -->|"1 · ciphertext PUT"| PX
    PX -->|"Bearer JWT"| PUB
    PUB -->|"blobId"| WAL
    B -->|"2 · 1 tx: create_policy + register_file · SUI gas"| SUI
    B -.->|"open: read blob · no wallet"| WAL
    B -.->|"seal_approve dry-run"| SEAL
    SEAL -.->|"policy ok → release keys"| B
    AG -->|"action plan"| B
    B -->|"confirm → wallet signs"| SUI
    AG -.->|"recall / remember"| MEM

Two-step write: encrypted bytes go to our Walrus publisher (which fronts the WAL cost and returns a content-addressed blobId); then one Sui transaction creates the access policy and records the FileObject (you pay only SUI gas). Reads hit the public aggregator — no wallet. Decryption is gated on-chain by seal_approve. No backend holds your bytes or keys.

What is Waldrive?

Three billion people store their most important files on platforms that can read them, lock them, or lose them. Waldrive flips the trust model:

🔒 Encrypted first - every file is sealed client-side with SEAL before it touches the network.
🐋 Stored on Walrus - encrypted blobs, distributed with erasure coding. You choose how long to store.
⛓️ Access on-chain - who can open a file is a Sui policy; SEAL key servers release keys only when it approves.
👛 Wallet = identity - no email, no password. Connect a wallet, or Sign in with Google (zkLogin).

How it works

Step	What happens	Where
1 · Encrypt	SEAL seals the file bytes in the browser against a random identity	client
2 · Store	Ciphertext → Walrus → blob ID (publisher pays gas - no user signature)	HTTP
3 · Control	One Sui tx registers the file; ownership of the `FileObject` gates decryption	1 signature

Uploading a file is a single wallet signature. Owner access needs no separate policy object - the owned FileObject is the access proof (the OnlyFins pattern). Sharing creates revocable AccessPolicy objects with per-recipient expiry and download limits.

🤖 AI assistant - acts and remembers

Agentic - “move my invoices into a Finance folder.” The agent (Claude, server-side) returns a confirm-first action plan; your wallet executes each step. No keys on the server.
Memory - via MemWal, the agent remembers preferences and past actions across sessions - itself encrypted on Walrus and owned by your wallet.
Privacy-preserving - grounded only on metadata + text you've already decrypted locally. Unopened encrypted content never leaves the browser.
Gated behind the Pro plan (enforced server-side against the on-chain subscription).

Smart contracts (6 Move modules)

Module	Responsibility	Errors
`admin`	AdminCap + SystemConfig (pause, fees, epoch duration)	0–99
`subscription`	Tiers, user subscriptions, promo codes, monthly USDC billing	100–199
`file_registry`	FileObject metadata + owner-only `seal_approve`	200–299
`access_control`	AccessPolicy + `seal_approve` (sharing / gating)	300–399
`collections`	Organize files into folders (owned, organizational)	400–499
`sharing`	ShareLink → AccessPolicy → FileObject	500–599

Tech stack

Frontend: Next.js 16 (App Router), React 19, TypeScript, Tailwind v4
Chain: Sui Move (6 modules, upgradeable package)
Storage: Walrus (erasure-coded blobs)
Encryption: SEAL (@mysten/seal, threshold IBE)
AI: Claude (@anthropic-ai/sdk) + MemWal (@mysten-incubation/memwal)
Wallet / auth: @mysten/dapp-kit-react, Enoki zkLogin (Sign in with Google)
Payments: USDC on Sui - 0xa1ec7fc0…::usdc::USDC

Repo structure

waldrive/
├── waldrive/            Sui Move contracts (6 modules) + Published.toml
├── waldrive_fe/         Next.js app (app.waldrive.xyz)
│   └── src/lib/
│       ├── seal/        SEAL encrypt / decrypt
│       ├── sui/         client, transactions (PTBs), queries
│       ├── ai/          agent run-plan, memory (MemWal), context
│       └── hooks/       subscription, collections, files providers
├── waldrive_landing/    Marketing site (waldrive.xyz) + /public/pitch.html
└── waldrive-brand/      Logo + favicon export

Local development

# Frontend
cd waldrive_fe
bun install          # or npm install
bun run dev          # http://localhost:3001

# Contracts
cd waldrive
sui move build
sui client upgrade --upgrade-capability <UpgradeCap>   # additive changes

Environment (`waldrive_fe/.env.local`)

See waldrive_fe/.env.example. Server-side keys are never NEXT_PUBLIC_.

# Sign in with Google (Enoki zkLogin)
NEXT_PUBLIC_ENOKI_PUBLIC_KEY=enoki_public_...
NEXT_PUBLIC_GOOGLE_CLIENT_ID=...apps.googleusercontent.com

# Walrus upload (server-only) - HMAC secret our publisher verifies upload JWTs with
WALRUS_JWT_SECRET=...

# AI (server-only)
ANTHROPIC_API_KEY=sk-ant-...

# AI memory - MemWal (server-only, optional; degrades gracefully if unset)
MEMWAL_PRIVATE_KEY=...           # delegate key from memory.walrus.xyz
MEMWAL_ACCOUNT_ID=0x...
MEMWAL_SERVER_URL=https://relayer-staging.memory.walrus.xyz

# Dev only - test AI without a paid plan (leave unset in prod)
NEXT_PUBLIC_AI_DEV_BYPASS=

License

Storage that can't read you, can't ban you, can't lock you in.

Sui · Walrus · SEAL · zkLogin · MemWal

Name		Name	Last commit message	Last commit date
Latest commit History 30 Commits
waldrive		waldrive
waldrive_fe		waldrive_fe
waldrive_landing		waldrive_landing
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

🗄️ Waldrive

Your files. Encrypted. Yours.

👩‍⚖️ For Judges - start here

🔗 Live

⛓️ Deployed Sui IDs

🎨 Display V2 (`sui::display_registry`) - registered & shared

🔐 SEAL - where & how it's used

🐋 Walrus - where & how it's used

🧠 MemWal (Walrus Memory) - AI agent memory

🗺️ Architecture at a glance

What is Waldrive?

How it works

🤖 AI assistant - acts and remembers

Smart contracts (6 Move modules)

Tech stack

Repo structure

Local development

Environment (`waldrive_fe/.env.local`)

License

About

Uh oh!

Releases

Packages

Uh oh!

Contributors

Uh oh!

Languages

Folders and files

Latest commit

History

Repository files navigation

🗄️ Waldrive

Your files. Encrypted. Yours.

👩‍⚖️ For Judges - start here

🔗 Live

⛓️ Deployed Sui IDs

🎨 Display V2 (sui::display_registry) - registered & shared

🔐 SEAL - where & how it's used

🐋 Walrus - where & how it's used

🧠 MemWal (Walrus Memory) - AI agent memory

🗺️ Architecture at a glance

What is Waldrive?

How it works

🤖 AI assistant - acts and remembers

Smart contracts (6 Move modules)

Tech stack

Repo structure

Local development

Environment (waldrive_fe/.env.local)

License

About

Topics

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

🎨 Display V2 (`sui::display_registry`) - registered & shared

Environment (`waldrive_fe/.env.local`)

Packages