Blockchain-Based Product Traceability System Development

Development of a Blockchain-Based Product Traceability System

Imagine a luxury goods manufacturer who implemented QR codes on packaging, yet counterfeits grew by 15% — fake QR codes led to phishing sites, and the real data didn't guarantee authenticity. Our team of blockchain engineers, with experience in 15+ traceability projects, has encountered this repeatedly. The root cause is the oracle gap: a physical product can be easily swapped while keeping the digital marker. We build systems where each product has a digital twin with cryptographic verification, and on-chain data is confirmed by a physical chip. As a result, clients save up to 95% on gas costs compared to full on-chain storage, with typical monthly savings of $5,000 for a flow of 10,000 products per day. Contact us for a free consultation on your traceability system architecture.

The Oracle Gap — The Main Vulnerability

The central technical problem in supply chain traceability is the oracle gap: the disconnect between the physical world and on-chain data. A product can be swapped while retaining the QR code or RFID tag. Solutions exist, each with trade-offs.

NFC with Clone Protection

NXP NTAG424 DNA chips implement a protocol with cryptographic challenge-response. Each scan generates a unique CMAC (Cipher-based Message Authentication Code) derived from an internal counter and an AES-128 key embedded at production. Cloning the chip without knowing the key is physically impossible. Verification:

Scan → Chip returns (UID, Counter, CMAC) → Backend verifies CMAC with stored key → Counter monotonically increasing? → Legit scan → Counter same as before? → Replay attack / counterfeit 

Keys are stored in an HSM (Hardware Security Module), not in the application. The fact of verification itself is recorded on the blockchain as an event, rather than static product data — an important architectural decision.

Physically Unclonable Functions (PUF)

For high-value items (jewelry, pharmaceuticals) — microstructure scanning: a unique material "fingerprint" that cannot be reproduced during manufacturing. Companies like Alitheon and Certilogo build systems on this principle. The algorithm boils down to computing a hash from a high-resolution surface image and storing a commitment on the blockchain at production. For verification, the product is re-scanned and features are compared.

IoT Sensors in the Supply Chain

For perishable goods (pharma, food): temperature/humidity sensors with data signed on the device (Trusted Execution Environment or secure element). Data is published via MQTT → Kafka → on-chain oracle. The de facto standard is integration with Chainlink Functions or a custom oracle based on Town Crier (TEE-based).

On-Chain Component Architecture

Network Selection and Data Model

Full on-chain storage for enterprise supply chains is overkill and expensive. The standard hybrid model:

For storing data hashes with availability, we use IPFS with pinning through Pinata or web3.storage. The contract stores only the CID (Content Identifier) and a hash of the content for integrity verification.

Asset Registry Contract

Minimal architecture — ERC-721 with supply chain extensions:

struct AssetRecord { bytes32 physicalId; // hash of NFC UID or PUF fingerprint address currentCustodian; uint256 mintedAt; bytes32 metadataCID; // IPFS CID of attribute batch uint8 status; // enum: MANUFACTURED, IN_TRANSIT, CUSTOMS, DELIVERED } event CustodyTransferred( uint256 indexed tokenId, address indexed from, address indexed to, bytes32 locationHash, uint256 timestamp ); event VerificationEvent( uint256 indexed tokenId, bytes32 indexed verifierHash, bool authentic, uint256 nfcCounter ); 

For chains with multiple participants (producer → exporter → logistics → customs → retail), we use roles via AccessControl. Each participant can record events only for their stage.

How Merkle Tree Batching Saves Up to 1000× on Gas?

With high event volumes (thousands of product units per day), directly recording each event on-chain is uneconomical. The solution — Merkle tree batching: aggregate events over a period (5–15 minutes), build a Merkle tree, and publish only the root on-chain. Individual events are verified by providing a Merkle proof. This approach reduces on-chain costs by 100–1000× compared to direct per-event recording — confirmed in practice. For example, on Polygon, one batch transaction costs about $0.01–$0.05, which is 10 times cheaper than a separate record. Typical savings for a client with a flow of 10,000 products per day — approximately $5,000 per month.

function submitBatch(bytes32 merkleRoot, uint256 eventCount, bytes32 batchCID) external onlyRole(BATCH_SUBMITTER_ROLE) { batches[batchNonce] = BatchRecord(merkleRoot, eventCount, block.timestamp, batchCID); emit BatchSubmitted(batchNonce++, merkleRoot, eventCount); } function verifyEvent(uint256 batchId, bytes32 leaf, bytes32[] calldata proof) external view returns (bool) { return MerkleProof.verify(proof, batches[batchId].merkleRoot, leaf); } 

This approach reduces on-chain costs by 100–1000× while maintaining cryptographic verifiability. For example, on Polygon, the cost of one batch transaction is about $0.01–$0.05, which is 10 times cheaper than a separate record.GS1 Digital Link

Which Blockchain Network to Choose for Traceability?

The choice depends on your priorities: if public verification is needed — Ethereum with L2, for confidentiality — private blockchain. We recommend starting with Polygon or Arbitrum for rapid deployment.

Integration with GS1 and Industry Standards

For a serious enterprise project, you can't invent identifiers from scratch. The GS1 Digital Link standard (ISO/IEC 18975) is a URL scheme for QR codes that allows one code to point to different resources depending on context. Our system implements a Digital Link resolver that for /01/{gtin}/21/{serial} returns on-chain data.

For pharmaceuticals — compliance with DSCSA (USA) and FMD (EU). Both require serialization and verification at each stage. The blockchain component replaces or supplements centralized registries.

Backend and Indexing

On-chain events are the source of truth, but direct on-chain queries are too slow for UIs. An indexer is necessary:

The Graph subgraph — declarative indexing of events into a GraphQL API. For supply chain: handlers handleCustodyTransferred, handleVerificationEvent, handleBatchSubmitted. Data is aggregated into entities Product, CustodyEvent, Participant.

Alternative for enterprise — a custom indexer in Go/Rust with PostgreSQL. More predictable latency (below 10ms), possibility of custom aggregations, no dependency on TheGraph Network.

How We Work: Stages of Creating a System (Turnkey Development)

1. Requirements analysis — study physical anchoring (NFC/PUF/IoT) and ERP integrations. We provide a free estimate.
2. Architecture design — choose blockchain, data model (ERC-721 + Merkle tree), and role scheme.
3. Smart contract development — Solidity 0.8.x, tests in Foundry, gas optimization.
4. Hardware integration — firmware for NFC chips, PUF scanner setup, MQTT bridge for IoT.
5. Testing — unit, integration, fuzzing (Echidna), audit with Slither + Mythril.
6. Deployment and monitoring — mainnet/testnet, Tenderly setup, Grafana.
7. Training and documentation — code handover, runbook, technical support for 3 months.

What's Included in a Turnkey Traceability System (Starting at $50,000)

• Requirements audit and physical anchoring analysis (RFID, NFC, PUF, IoT)
• Architecture documentation and blockchain network selection
• Smart contract development in Solidity (ERC-721 with extensions)
• Integration of NFC/QR scanners with cryptographic verification
• Backend indexer (The Graph or custom Go indexer)
• Web portal for verification and product management
• Unit, integration, and security testing (Slither, Mythril, Echidna)
• Deployment to mainnet/testnet and monitoring setup (Tenderly)
• Customer team training and documentation
• Technical support for 3 months

Estimated Timelines and How to Start

Realistic timeline for an MVP with NFC verification, two or three participant roles, and a basic portal — 10–14 weeks (starting at $50,000). A full system with IoT integration, GS1 compliance, and enterprise SSO — from 6 months. We estimate the project after a free audit. Contact us for a free consultation on your traceability system architecture. Receive a commercial proposal tailored to your requirements. Our engineers have experience in blockchain development and have successfully completed 15+ traceability projects — from luxury goods to pharmaceuticals. Request a free estimate today.