Integrate Gitcoin Passport: Anti-Sybil Protection for Your dApp

Sybil attacks are the primary threat for dApps handling grants, voting, or token distribution. In one project we found that 30% of active wallets were bots created to farm an airdrop. Instead of building custom KYC (which would have taken 2–3 months of team effort), we integrated Gitcoin Passport in 2 days and blocked 95% of sybil accounts. Our track record: 5+ years in Web3, over 50 identity solution integrations, trusted by 30+ dApps.

Users collect stamps — verifications from 40+ sources (GitHub, Twitter, ENS, BrightID, on-chain activity) — and the protocol computes an identity score from 0 to 100. The dApp uses the score to decide: allow, restrict, or block. Below are real code snippets and comparisons so you can evaluate the effort.

Why Gitcoin Passport Beats Custom KYC

Gitcoin Passport is up to 20x faster and 10x cheaper than building your own sybil protection. Custom verification requires 2–3 months of two developers — a budget of $30,000–$50,000. Gitcoin Passport solves it in 1–3 days at a cost starting from $2,500. Plus it's decentralized: data stays with the user, and score is computed off-chain or on-chain. Gas costs only apply for on-chain verification (~0.001 ETH per check).

Compare integration methods:

Which Stamps Are Supported?

Gitcoin Passport collects data from over twenty providers: GitHub (account older than 90 days), Twitter (verified), ENS (domain older than 30 days), BrightID, Proof of Humanity, DeFi protocol activity, and more. Each stamp adds points to the score. For example, GitHub — 5, ENS — 3, BrightID — 7, Dework — 2. The access threshold is configurable; typically 15–20 points suffice to block 95% of sybil accounts. We helped one DeFi project set a threshold of 20 points — farmers couldn't bypass it, while legitimate users passed without issues.

What Is Identity Score and How Is It Calculated?

The score is computed by Gitcoin's aggregator using a weighted formula. The more unique and verifiable credentials a user collects, the higher the score. For instance, connecting BrightID — one of the most reliable decentralized identifiers — gives 7 points. An ENS domain older than 6 months adds another 5. If a user collects 6 different stamps, the score reaches 20+ — enough for grants and voting. We helped a project configure a custom formula that combines stamps with on-chain history (number of transactions, wallet age).

How We Integrate Gitcoin Passport: Proven Stack

We use current versions: Solidity 0.8.x, TypeScript, React (wagmi + RainbowKit), ethers.js. Below is code from real projects.

Integration via Passport SDK

import PassportVerifier from '@gitcoinco/passport-sdk-verifier'; const verifier = new PassportVerifier(); async function checkPassport(address: string) { const passport = await verifier.verifyPassport(address); const score = await verifier.getPassportScore(address); return { hasPassport: !!passport, score, stamps: passport?.stamps || [] }; } 

On-chain Integration via EAS

Gitcoin provides a scorer API and on-chain attestations through EAS (Ethereum Attestation Service). The on-chain verification leverages EIP-712 typed data and EAS attestations, ensuring cryptographic trust. Example smart contract with a score threshold:

interface IGitcoinPassportDecoder { function getScore(address user) external view returns (uint256); function getPassport(address user) external view returns (Credential[] memory); } contract ProtectedFeature { IGitcoinPassportDecoder passport; uint256 public constant MIN_SCORE = 15; modifier requiresPassport() { require(passport.getScore(msg.sender) >= MIN_SCORE, "Gitcoin Passport score too low"); _; } function accessGatedFeature() external requiresPassport { } } 

Smart contract access control with Gitcoin Passport ensures only verified users interact with critical functions.

Server-Side Integration via Scorer API

const response = await fetch( `https://api.scorer.gitcoin.co/registry/score/${SCORER_ID}/${walletAddress}`, { headers: { 'X-API-Key': process.env.GITCOIN_API_KEY } } ); const { score, passing_score } = await response.json(); 

Our integration is ideal for DeFi grants, enabling sybil-proof distribution.

How to Choose Between SDK and On-chain?

Passport SDK is 3x faster to deploy — no contract writing or gas payments. On-chain provides atomicity: check and action in one transaction. For most DeFi apps, SDK is sufficient. If you need tamper-proof verification at the RPC level or autonomy from a server, use on-chain.

Common Newbie Mistakes

• Setting too low a threshold (score < 10) — lets bots through.
• Missing a fallback to refresh stamps — users cannot recalculate score after adding new stamps.
• Ignoring regional providers (e.g., BrightID) — reduces coverage.

Deliverables: What Our Work Includes

• Audit of your dApp architecture and method selection.
• Setup of SDK/contract/API to fit your stack.
• Development of custom score thresholds (e.g., different access levels).
• Sybil resistance testing via fuzzing.
• Documentation and team training.
• One month of post-launch consultation.

Stages of Work

1. Analysis — study identity score use cases.
2. Design — choose method, design contracts/endpoints.
3. Implementation — write code, connect to testnet.
4. Testing — load testing, security audit.
5. Deployment — deploy to mainnet, set up monitoring.

Timelines and Cost

Basic integration — from 1 to 3 days. Complex projects (multiple chains, asynchronous verification) — up to 2 weeks. Cost is calculated individually and fixed before start. Example: one DeFi dApp saved $12,000 by choosing Gitcoin Passport over building their own sybil protection. Protect your dApp from sybil attacks today. Contact us for a project evaluation — our Web3 engineers can tailor Gitcoin Passport to your use case.

Get a consultation on integrating Gitcoin Passport into your dApp. Order an audit and implementation — we will propose the optimal solution.