There is a peculiar kind of theft that leaves no fingerprints. No wallet is drained, no private key is compromised, no alarm sounds in the night. It happens when the same ton of avoided carbon is claimed twice โ once by the airline that purchased the sustainable fuel, once by the passenger who paid a surcharge for it, and, if no one is watching, a third time by the fuel producer eager to polish an ESG report. In carbon markets, this is called double counting. It is the quietest fraud in the world, because the commodity being stolen is invisible, and because everyone involved can honestly believe they are doing good.
This is the problem Petrobras, Brazil's state-controlled energy giant, says it wants to solve. In late September, the company and the Cardano Foundation announced a research collaboration with PUC-Rio's Ledger Labs โ a tokenized model for sustainable aviation fuel, built on Cardano, engineered so that each environmental claim can be spent exactly once. The mechanism is called Book-and-Claim. The token is called CS-SAF. On paper, it is a small announcement. In spirit, it is an argument about what a carbon claim is worth, and who gets to decide.
My first reaction, reading the disclosure, was not excitement. It was the question I have asked in every audit since I was twenty-one: we can make the ledger immutable, but can we make the claim honest?
To understand why this matters, you have to understand what sustainable aviation fuel actually is, and why its accounting is so fragile. SAF is a drop-in replacement for jet kerosene, derived from used cooking oil, agricultural residue, or synthetic feedstocks. It is expensive โ often two to five times the price of conventional fuel โ and its entire commercial rationale rests on the environmental attributes it carries. Those attributes are not the fuel itself. They are a separate, intangible good: the right to claim a reduction in emissions.
That separation is what makes carbon accounting so treacherous. Under the Book-and-Claim model, a passenger can purchase the environmental benefit of SAF without the physical fuel ever reaching their specific aircraft. The fuel is delivered somewhere in the network; the claim is "booked" by the buyer. It is an elegant idea, and it is exactly the kind of elegance that invites abuse. If the claim is a digital object, it can be copied. If it can be copied, it can be double counted. And if it can be double counted, the entire market loses its reason to exist.
The regulatory scaffolding here is CORSIA โ the Carbon Offsetting and Reduction Scheme for International Aviation, administered by ICAO โ which sets the rules for how airlines may claim emissions reductions. Alongside it sits the RSB, the Roundtable on Sustainable Biomaterials, whose June guidance tentatively accepted the Book-and-Claim approach while insisting that airlines "disclose supported reductions separately from operational emissions." That single sentence โ separate disclosure โ is where the real engineering challenge begins, because it demands that a token carry not just value, but context.
This is the stage on which Cardano enters, and it is worth being precise about who is actually building. Petrobras is not a startup. It is a national champion, majority-owned by the Brazilian state, with all the political exposure that implies. The Cardano Foundation is a Swiss non-profit, the stewardship body of a proof-of-stake network that has spent years trying to convert philosophical ambition into enterprise credibility. PUC-Rio's Ledger Labs supplies academic weight. It is a serious coalition, and it is a coalition whose incentives do not perfectly align.
I have watched this pattern before. In 2017, as a twenty-one-year-old undergraduate, I spent six months auditing the governance models of emerging DAO prototypes, including the 1Balance project, and documented three voting-centralization risks in a forty-page analysis. The lesson I carried out of that work was not that decentralization fails, but that it is fragile in ways the code alone never reveals. The same discipline applies here. A carbon token is only as trustworthy as the authority that mints it, checks it, and finally burns it.
Let me describe what the CS-SAF token actually does, because the marketing language obscures a fairly simple machine. The token has a four-part lifecycle: it can be created, transferred, checked, and destroyed. The destroy step is the innovation. When a claim is redeemed, the token is burned โ permanently removed from circulation โ so that the same environmental attribute cannot be claimed again. It is, in essence, a double-spend prevention mechanism borrowed from the oldest problem in digital cash, applied to an entirely new asset class.
The technical heart of this project is not blockchain. It is a burn function that closes the loop on a claim. Strip away the token vocabulary and what remains is lifecycle management: creation, transfer, verification, destruction. This is the same logical skeleton as an NFT โ mint, trade, verify, burn โ and its complexity is moderate at best. There is no novel consensus mechanism here, no new cryptography, no breakthrough in scaling. The novelty is institutional: a national energy company agreeing to let a public blockchain mediate its environmental claims. That is a meaningful step, but it is a step in governance, not in engineering.
The choice of Cardano is more deliberate than it first appears. Cardano's native asset standard allows tokens to carry metadata and to move without invoking a smart contract โ a design that suits asset-tracking far better than general-purpose computation. If CS-SAF is implemented as a native asset rather than a Plutus contract, the platform gains simplicity and auditability at the cost of flexibility. I would bet, with moderate confidence, that this is the path chosen, because it matches the use case exactly: the token is a certificate, not a program. That simplicity is a virtue for auditing, and a constraint for anyone who imagines the token doing something clever later.
And the metadata is the point. Each CS-SAF token is meant to align with CORSIA definitions, so that the claim it represents is legible to regulators, auditors, and the airlines that must report under the scheme. That alignment is the difference between a corporate science experiment and infrastructure. A token that speaks CORSIA can travel; a token that speaks only Petrobras stays home. The real ambition here is not to track fuel. It is to become a piece of the global carbon market's plumbing. The catch is that plumbing built to one ecosystem's metadata standard may not connect to another's โ interoperability, not innovation, is the boundary condition.
The scope extends beyond aviation. The same collaboration includes Diesel R, a parallel project that places checkpoints at the production, transport, and use stages of diesel's lifecycle, feeding Scope 3 reporting โ the indirect, value-chain emissions that most companies find hardest to measure. Diesel R is where the architecture shows its ambition. Aviation is the beachhead; road transport and supply-chain accounting are the territory. If the model works for jet fuel, it can be pointed at any commodity whose environmental attributes need to be separated from the commodity itself: iron ore, soy, cotton, hydrogen. That is a genuinely large idea, and it deserves to be described as one.
Now the sobering part, and I want to state it plainly because the disclosure does. This is research and development, not a deployed product. The Cardano Foundation itself describes the work as a "model proposed in ongoing R&D." There is no mainnet launch date. There is no transaction volume. There is no revenue. The disclosure offers no throughput figures, no latency data, no cost-per-claim, no list of airlines or corporate buyers who have signed on. When I reverse-engineered Harvest Finance during DeFi Summer and found that its yields were token emissions dressed as economic utility, the tell was the same: an impressive surface with no load-bearing numbers underneath. Here, the surface is a sustainability narrative; the load-bearing number โ commercial use โ is explicitly unquantified. That absence is not a footnote. It is the story.
What about the token's economic nature? There is none, and this is worth celebrating. CS-SAF is not an investment asset; it is an environmental attestation. It cannot be traded, cannot be speculated on, carries no yield, and fails every prong of the Howey test. There is no team allocation, no vesting schedule, no liquidity pool, no APR. The word "token" is doing misleading work here; a more honest term would be "on-chain certificate." And because the token is not tradable, its value capture for Cardano's native asset, ADA, is close to nil. Even if the platform reached full commercial scale, carbon-attribute tracking generates a trickle of transactions โ nothing that would register against the network's overall fee revenue. Anyone reading this as an ADA catalyst is reading it wrong.
The competitive field is instructive. Toucan Protocol, built on Celo, has already bridged carbon credits on-chain and holds real volume. Verra remains the incumbent registry, the standard-setter with the deepest network effects, and the entity most threatened by any credible attempt to automate carbon accounting. IBM and Maersk's TradeLens โ a supply-chain blockchain that was technically competent and commercially abandoned โ is the cautionary tale that every enterprise blockchain team should have pinned above its desk. And in China, Ant Group's carbon management tools have quietly integrated with Alipay's consumer scale. Cardano's differentiator is narrow but real: CORSIA alignment and the backing of a national energy champion. Its weakness is equally real: it has no network effects in carbon markets, and network effects are the only currency that matters in registries.
Governance deserves its own scrutiny. This is not a DAO. There is no proposal forum, no token-vote, no on-chain treasury. Decisions are made inside a state-controlled corporation and a Swiss foundation, and key choices โ who mints, who verifies, who can pause the burn โ will not be published in a governance post. For a project whose entire premise is that a claim should be spendable exactly once, the authority that controls the mint and the burn is the single most important thing, and it is the least documented. In my 2017 audit, the risks I found were never in the cryptography. They were in the quiet concentration of control. The same lens applies here, and it should make any careful reader ask who holds the keys to the destroy function.
Here is where I part company with the enthusiasm. The most common failure mode for enterprise blockchain is not technical collapse. It is the proof-of-concept trap โ a project that works beautifully in a pilot, wins a press release, and never crosses into production because the incentives to scale it were never assembled. The disclosure's admission that commercial use "cannot be quantified" is the signature of a PoC, and PoCs have a mortality rate that should humble anyone who writes about them. I have watched this exact shape of story for eight years, and the tell is always the same: an application that exists, and a market that does not.
There is a deeper problem, and it is the one I keep returning to in my audits: blockchain guarantees that on-chain data is unaltered. It cannot guarantee that on-chain data is true. Diesel R places checkpoints at production, transport, and use โ but a checkpoint is only as honest as the entity that reports to it. If a fuel producer enters an inflated reduction figure, the ledger will faithfully, immutably, and permanently preserve the lie. Immutability is not integrity. It is only the refusal to forget. This is the oldest confusion in our industry, and it is not solved by any amount of cryptography.
Then there is the minimal viable network problem. Book-and-Claim only functions when the buyer, the seller, and the verifier all participate simultaneously. Airlines must want the claims; fuel producers must issue them; CORSIA and the RSB must recognize them. A blockchain can coordinate these parties, but it cannot compel them. And the RSB's insistence on separate disclosure, while principled, adds compliance friction for the very airlines the model needs. Every additional reporting requirement is a reason to say no. We audit the code, but who audits the conscience? I do not say this to dismiss the work. I say it because the credibility of a carbon claim depends ultimately on the credibility of the claimant, and no burn function can substitute for that. It is worth remembering, too, that this infrastructure is being built by a national oil company โ an entity whose core business is the extraction of the very carbon the ledger is meant to account for. That is not a disqualification. It is a tension that a careful reader should hold, not resolve too quickly.
And yet. Build not for the peak, but for the plain. The carbon market is unglamorous, slow, and governed by committees in Montreal and Geneva โ precisely the kind of terrain where durable infrastructure gets laid while speculators look elsewhere. If CORSIA's mandatory phase arrives in 2027 as scheduled, the demand for verifiable, non-double-counted claims will not be a narrative. It will be a legal requirement. I have spent a bear market writing into the silence, and I have learned that the work that survives the noise is rarely the work that made the noise. The question worth carrying forward is not whether Cardano wins this race. It is whether any of us will notice, in three years, that the quietest infrastructure in the industry was being built by an oil company and a research lab, far from the crowd. When the sky is finally accounted for honestly, will we be able to say we were paying attention?
