Zero-Knowledge Proof-Based Privacy-Preserving Pharmaceutical Traceability and Recall Using Blockchain

Abstract

Counterfeit and unsafe medicines pose significant risks to patient safety and undermine trust in healthcare systems. This paper presents ACTMeds, a blockchain-supported pharmaceutical traceability and recall platform that considers pharmaceutical supply chain requirements and public health operational needs relevant to the Australian Capital Territory (ACT). The system integrates Ethereum smart contracts, developed using Ganache, with a React-based web application providing regulator, operator, pharmacy, and auditor interfaces, alongside a public verification portal leveraging QR and GS1 barcodes. In addition, role-based access control is enforced across the medicine lifecycle, including manufacture, custody transfer, dispensing, and recall, with immutable on-chain events generated to support auditability and accountability. To balance transparency with confidentiality, the platform prototypes a zero-knowledge (ZK) recall mechanism in which regulators can cryptographically prove that recall conditions meet predefined policy requirements without disclosing sensitive incident details. Threat modeling was conducted using the STRIDE framework, and security evaluation combined static application security testing (Solhint and ESLint) and dynamic testing. The paper further discusses deployment options, cost considerations, ZK recall performance analysis, ethical implications, and future enhancements. Security testing validated the platform’s resilience, with no high-severity vulnerabilities identified and medium-severity issues related to HTTP security headers addressed. The results indicate that a regulator-led, privacy-preserving, tamper-evident ledger can improve medicine authenticity verification and recall responsiveness while maintaining compliance and data protection obligations.