Quest/Task Platform Development for Crypto Projects

Quest/Task Platform Development for Crypto Projects

We build quest platforms turnkey—from designing on-chain verification to deploying reward smart contracts. The client's main pain: how to prove a user completed a task without trusting their word? On-chain actions require transaction verification via RPC, while off-chain actions need OAuth integration. Any verification loophole opens the door for sybil attacks, where one user boosts their rating with hundreds of wallets.

In practice, verifying Ethereum transactions takes 2–5 seconds, and token balance checks can take up to 10 seconds during network congestion. For off-chain tasks like Twitter follow, verification time is under 1 second. However, fast verification doesn't guarantee protection against abuse—a comprehensive approach using snapshots and anti-sybil filters is required.

We use a combination of methods: for off-chain—OAuth 2.0 with PKCE (Twitter, Discord), for on-chain—RPC calls via publicClient with event confirmation. Each request is logged, and data is cached for 5 minutes to avoid redundant blockchain queries.

Task Verification: On-Chain vs Off-Chain

Off-Chain Tasks

Twitter follow, Discord join, email subscription—verification via OAuth:

• Twitter: OAuth 2.0 with PKCE, verification via Twitter API v2 (GET /2/users/:id/following)
• Discord: OAuth2 + Discord Bot API for checking server membership and role assignment
• Telegram: Telegram Login Widget + Bot API (getChatMember)

All this is server-side logic. OAuth tokens must be stored encrypted and refreshed—Twitter access token lives 2 hours.

On-Chain Tasks

This is more interesting and complex. Typical categories:

• Holder verification—user must hold X tokens or NFTs from a specific collection. Verification: balanceOf(address) call via RPC. Simple, but you need to handle the time check—balance might have existed at snapshot time but not now.
• Transaction verification—user performed a swap, provided liquidity, made a bridge. Verification via indexer or RPC:

// Check if the address did a swap on Uniswap v3 in the last N days const logs = await publicClient.getLogs({ address: UNISWAP_V3_ROUTER, event: parseAbiItem('event Swap(address indexed sender, address indexed recipient, ...)'), args: { recipient: userAddress }, fromBlock: BigInt(fromBlock), toBlock: 'latest', }) const completed = logs.length > 0 

• Contract interaction—user called a specific function of your contract. The most reliable method: emit an event in the contract, index it.

Comparison of On-Chain and Off-Chain Verification

How to Protect Against Sybil Attacks?

The main problem with quest platforms is sybil attacks. One person creates 1000 wallets, completes all tasks, collects rewards. We use a combination of methods:

• Gitcoin Passport—score based on Web2 and Web3 activity. API: GET /registry/score/:address. A score threshold (e.g., 15+) eliminates most sybil accounts.
• Proof of Humanity / Worldcoin—biometric proof of unique human. More reliable but creates friction for users.
• On-chain activity score—check wallet age, number of transactions, ETH/asset holdings. A new wallet with zero history is a red flag.
• Rate limiting by IP + fingerprint—not perfect but filters out lazy bot operators.

System Architecture

Backend

REST API (Next.js API routes or Express) ├── /api/quests — list quests, status ├── /api/verify/:taskId — verify a specific task ├── /api/claim — claim reward after completing all tasks └── /api/leaderboard — top users by XP 

Database — PostgreSQL:

• users: address, twitter_id, discord_id, passport_score
• quests: id, title, reward_type, reward_amount, requirements JSON
• task_completions: user_id, task_id, verified_at, proof JSON
• rewards_claimed: user_id, quest_id, tx_hash

Smart Contract for Rewards

If the reward is tokens or NFTs, a contract is needed:

contract QuestRewards { mapping(address => mapping(uint256 => bool)) public claimed; function claimReward( uint256 questId, bytes32[] calldata merkleProof ) external { require(!claimed[msg.sender][questId], "Already claimed"); require( MerkleProof.verify(merkleProof, questRoots[questId], keccak256(abi.encodePacked(msg.sender))), "Invalid proof" ); claimed[msg.sender][questId] = true; token.transfer(msg.sender, questRewards[questId]); } } 

Merkle tree approach: the backend compiles the list of eligible addresses, calculates the Merkle root, and publishes it on-chain. The user receives a Merkle proof from the server and claims themselves, paying gas. This reduces server load and decentralizes claiming. More about Merkle tree can be read on Wikipedia.

Frontend

Key screens:

• Dashboard — active quests, progress, accumulated XP
• Quest detail — list of tasks with statuses (locked/available/completed/claimed)
• Leaderboard — top participants, can be weekly/all-time
• Profile — reward history, connected socials

UX detail: task verification status should not be synchronous. User clicks "Verify" — show spinner, backend makes the request, checks on-chain/off-chain data, returns result. Typical time — 2–5 seconds for on-chain verification.

What's Included in Turnkey Development?

Our engineers have 10+ years of experience in smart contract development and over 50 successful DeFi and NFT projects. We use Foundry for contract testing and Tenderly for monitoring.

Estimated Timelines

Basic system with a few task types and verification — from 1 week. Full platform with anti-sybil, Merkle-based claiming, and integrations — up to 2 weeks. We'll give an exact estimate after analyzing your requirements.

Common Mistakes in Quest Platform Development

• Using only off-chain verification without on-chain — users cheat the system.
• Lack of snapshot logic — rewards go to those whose balance existed for a second.
• Synchronous verification — user waits for response, interface freezes.
• No sybil protection — rewards go to bots.

Avoiding these problems requires proper architecture and an experienced team. If you are developing a crypto project and want to implement a quest system, contact us for a free project assessment.