AfterClass
AfterClass is a zero-account anonymous real-time communication platform engineered with FastAPI WebSockets, an Ethereum Sepolia ERC-20 utility token ($AFTER) with EIP-2612 gasless permits, SQLite WAL concurrency, automated Cloudflare Tunnel ingress, deterministic photographic animal avatars (160+ species), and privacy-preserving EXIF metadata sanitization.
Project Overview
AfterClass is a zero-account anonymous real-time communication platform engineered with FastAPI WebSockets, an Ethereum Sepolia ERC-20 utility token ($AFTER) with EIP-2612 gasless permits, SQLite WAL concurrency, automated Cloudflare Tunnel ingress, deterministic photographic animal avatars (160+ species), and privacy-preserving EXIF metadata sanitization.
Problem Statement
Traditional messaging networks demand invasive personal identifiers (phone numbers, emails, social logins), persist invasive device telemetry, and store user metadata in centralized databases susceptible to leaks and surveillance. Furthermore, monetizing or supporting creators on anonymous platforms has historically required fiat payment rails (credit cards, PayPal) that completely destroy pseudonymity via mandatory KYC. Self-hosted message boards also expose the host's residential IP address, require complex router port-forwarding, suffer from database write-lock contention under concurrent room traffic, and leak geographic coordinates through unstripped image EXIF metadata.
Objectives & Scope
Project Objectives
- 01Deploy custom ERC-20 utility token ($AFTER) on Ethereum Sepolia with built-in faucet and post tipping
- 02Implement EIP-2612 off-chain permit signatures to eliminate gas fees for participant microtransactions
- 03Build high-resilience Web3.py backend service with multi-provider RPC failover and event verification
- 04Build a zero-account anonymous messaging platform with sub-50ms WebSocket message propagation
- 05Isolate host machine origin IP and network location via outbound Cloudflare Tunnel routing
- 06Automate in-memory EXIF metadata stripping on all uploaded image attachments
- 07Support 500+ simultaneous WebSocket sessions using SQLite WAL mode and async batch broadcasting
Scope & Boundary
Asynchronous WebSocket connection management, Ethereum Sepolia smart contract deployment (ERC-20 $AFTER & PremiumStore), Web3 multi-RPC daemon service, client-side MetaMask integration with EIP-712 permit signing, Cloudflare Tunnel ingress routing, client session hashing, server-side media EXIF sanitization, sliding-window rate limiting, and local host administration. Mainnet financialization and fiat ramps are explicitly out of scope.
Threat Model & Requirements
Adversary Model: External network eavesdroppers attempting origin IP discovery, financial de-anonymization via wallet clustering, replay attacks on off-chain permit signatures, and malicious users spamming socket floods. Security Objectives: Origin IP confidentiality via outbound tunnel; user location privacy via EXIF stripping; financial privacy via testnet tokens with no KYC; replay protection via EIP-712 domain separators and monotonic contract nonces; availability protection via 1.2s sliding-window rate limiting and 650-socket hard caps; host administration restricted via 256-bit tokens and brute-force lockout.
Architecture
Clients connect via either local LAN or public Cloudflare Tunnel. Users may optionally link an Ethereum/Base Sepolia wallet via MetaMask to claim free testnet $AFTER tokens and tip posts. The FastAPI ASGI application sanitizes all incoming headers, handles WebSocket lifecycle handshakes, and applies sliding-window rate limiting. When a Web3 action occurs (tipping, VIP perk purchase), the client signs an EIP-2612 permit submitted to the Web3.py service, which dispatches the transaction through multi-provider RPCs to the smart contracts on Sepolia. Incoming chat messages persist to SQLite in WAL mode before parallel fan-out via asyncio.gather.
+-------------------------------------------------------------------+ | AFTERCLASS ARCHITECTURE STACK | +-------------------------------------------------------------------+ | | | [Remote Clients] [MetaMask / Web3 Wallets] | | | | | | v (Outbound TLS) v (EIP-712 Permits)| | +-------------------+ +---------------------+ | | | Cloudflare Tunnel | | Ethereum Sepolia | | | | (Origin Masked) | | Smart Contracts: | | | +-------------------+ | - $AFTER ERC-20 | | | | | - PremiumStore.sol | | | v +---------------------+ | | +---------------------------------------------+ | | | | FASTAPI ASYNC WEBSOCKET ENGINE | | | | | - Header Sanitizer (No Server Leaks) | | | | | - Connection Manager (500 Sockets, Batch) |<-----+ | | | - Sliding-Window Rate Limiter | Web3.py Multi | | | - Web3 Service (Infura / Tenderly / dRPC) | RPC Failover | | +---------------------------------------------+ | | | | | | v v | | +--------------------+ +--------------------+ | | | Pillow EXIF | | SQLite WAL Engine | | | | Sanitizer (GPS/ | | (64MB Cache, Multi | | | | Hardware Scrub) | | Column B-Trees) | | | +--------------------+ +--------------------+ | | | +-------------------------------------------------------------------+
AfterClass Architecture Decomposition
Zero-account anonymous real-time communication platform built on FastAPI, asynchronous WebSockets, SQLite WAL mode, and automated Cloudflare Tunnel ingress with Ethereum Sepolia ERC-20 utility tokens ($AFTER), gasless EIP-2612 permits, deterministic animal avatars, EXIF metadata stripping, and host privacy defense mechanisms.
AfterClass Core
Real-Time Messaging Engine
FastAPI / Starlette WS
Async Batch Broadcaster
Socket Lifecycle Manager
Blockchain & Web3 Micropayments
ERC-20 Token ($AFTER)
EIP-2612 Gasless Permits
Web3.py Fallback Engine
MetaMask Anonymous Linker
Host Security & Anti-Leak
Cloudflare Tunnel (cloudflared)
Header Sanitizer & CSP
256-Bit Token Host Auth
Media Privacy & Sanitization
Pillow EXIF Sanitizer
160+ Species Avatar Generator
Storage & Concurrency Layer
SQLite WAL Mode
Multi-Column B-Tree Indexes
Moderation & Rate Limiting
Sliding-Window Anti-Flood
Local Host Real-Name Tagging
Implementation
Engineered an asynchronous real-time message exchange using FastAPI and Starlette WebSockets backed by SQLite in Write-Ahead Logging (WAL) mode, combined with a comprehensive Ethereum Sepolia / Base Sepolia Web3 micropayment architecture. Authored and deployed custom Solidity smart contracts: the AfterClass ERC-20 utility token ($AFTER) featuring an automated cooldown faucet and on-chain post tipping events, alongside PremiumStore.sol supporting EIP-2612 gasless permit signatures (ECDSA r, s, v) so users can purchase cosmetic VIP badges and spotlight glows without paying gas fees. Built an asynchronous Web3.py backend service with multi-provider RPC failover (Infura, Tenderly, dRPC, Ankr) for non-blocking transaction confirmation, coupled with automated Cloudflare Tunnel daemon routing, in-memory Pillow EXIF stripping, and 256-bit cookie token host administration.
Technologies & Rationale
Custom testnet token standard deployed on Ethereum Sepolia and Base Sepolia. Implements an automated cooldown faucet and on-chain PostTipped event logs, enabling trustless, zero-cost tipping for insightful posts without compromising user pseudonymity.
Enables off-chain cryptographic permit signatures (EIP-712 typed structured data) verified on-chain via ECDSA. Allows users to authorize token transfers and buy VIP cosmetic perks in a single atomic transaction without requiring testnet ETH for gas.
High-resilience blockchain service with round-robin and health-check fallback across Infura, Tenderly, dRPC, and Ankr nodes, guaranteeing reliable event log polling, receipt verification, and non-blocking background queueing.
Non-blocking asynchronous ASGI event loop with asyncio.gather batch broadcasts, supporting 500+ concurrent active connections with sub-50ms message delivery.
Write-Ahead Logging decouples concurrent readers from writers, eliminating database lock contention during high-velocity chat bursts while maintaining transactional durability.
Creates outbound-only TLS connections to Cloudflare Edge, masking the host origin IP and physical location without opening inbound firewall ports.
Decodes and re-encodes image byte streams in memory to permanently scrub GPS tags, camera serials, and timestamps before storage.
Testing Methodology
Smart contracts compiled and verified on Ethereum Sepolia testnet using Foundry/Hardhat and Remix IDE. EIP-2612 permit signatures tested with mock and MetaMask signers confirming successful gasless token transfers and permit deadlines. Multi-RPC fallback verified by simulating network dropouts on primary RPC nodes. Chat engine load-tested on Linux hardware simulating 500 concurrent active WebSocket connections with concurrent message broadcasts. EXIF stripping verified across JPEG/PNG files confirming zero GPS or hardware tags remain.
Results & Evidence
Successfully processed on-chain testnet $AFTER token tips and gasless VIP perk activations with ~12s Sepolia block finality. Multi-RPC fallback switches providers in under 200ms upon upstream rate-limiting. Chat platform maintains sub-30ms message delivery across 500 simulated concurrent sockets with zero SQLite table lock exceptions.
Limitations & Trade-offs
Single-node architecture limits scale to single-host memory and file-descriptor limits (~65,000 sockets max on Linux). Cloudflare Tunnel depends on Cloudflare Edge availability.
Future Improvements
Implement end-to-end encrypted room key ratcheting (Signal/Double Ratchet protocol). Add decentralized peer-to-peer WebRTC mesh for ephemeral rooms. Package as a one-click Docker container with hardware security enclave support.
Resources & Code
Repository URL: https://github.com/prajwalk-cyber/Afterclass