L-PoPI: Cross-Layer Physical-to-EVM Attestation for DePIN IoT

Decentralized Physical Infrastructure Networks (DePIN) need attestation that binds digital claims to physical devices. We present Lightweight Proof-of-Physical-Integrity (L-PoPI), a physical-to-Ethereum Virtual Machine (EVM) attestation framework combining SRAM-PUFs, BCH-based fuzzy extraction, FE-derived Groth16/Poseidon proofs, freshness-aware EVM verification, and a separate post-attestation behavioral branch. Physical validation used 30 cold-power ESP32 acquisitions and a pilot-scale six-board, 180-response campaign; BCH-C recovered 10/10 prospective and 60/60 held-out responses, and mean inter-device normalized Hamming distance was 49.22% in the homogeneous five-device cohort. The reconstructed key feeds a 1034-constraint Groth16 relation; host proving averaged 64.37 ms, verification averaged 10.11 ms, and stateful EVM attestations consumed 241,121 and 212,179 gas. A prospective ESP32-to-gateway experiment processed 904/906 PCAP windows; 798 controlled benign windows stayed below the fixed 0.512 risk threshold, with 441.59 ms mean decision latency. A scoped compositional argument prevents behavioral evidence from bypassing failed hard attestation, while [272, 128] code-offset helper exposure is bounded by 144 bits. Results support artifact-linked physical-to-EVM attestation with separate behavioral evidence. Boundary reminder: the six-device study is pilot-scale, and the online behavioral experiment used benign traffic only; neither supports manufacturing-scale population claims or online attack-recall estimates.