Airdrop

function submitProof(
    uint256[2] calldata pA,
    uint256[2][2] calldata pB,
    uint256[2] calldata pC,
    uint256[3] calldata pubSignals, // [workspaceHash, claimantAddress, tierIndex]
    bytes calldata approvalSig,     // ECDSA sig from IP-gate server
    uint256 powNonce                // Proof-of-work nonce
) external {
    // 1. Basic checks (window, already claimed, address, workspace, tier)
    ...

    // 2. IP Gate — verify server-signed ECDSA approval (~3K gas)
    bytes32 msgHash = keccak256(abi.encodePacked(
        msg.sender, workspaceHash, "LOBSTR_AIRDROP_APPROVAL"));
    bytes32 ethHash = msgHash.toEthSignedMessageHash();
    require(!_usedApprovals[ethHash], "Approval already used");
    _usedApprovals[ethHash] = true;
    require(ethHash.recover(approvalSig) == approvalSigner,
        "Invalid approval");

    // 3. PoW — verify computational work (~100 gas)
    require(uint256(keccak256(abi.encodePacked(
        workspaceHash, msg.sender, powNonce))) < difficultyTarget,
        "Insufficient PoW");

    // 4. ZK proof — Groth16 pairing check (~200K gas)
    require(verifier.verifyProof(pA, pB, pC, pubSignals),
        "Invalid proof");

    // 5. Allocate: New 1K | Active 3K | PowerUser 6K LOB
    ...
}