-
Notifications
You must be signed in to change notification settings - Fork 0
Verification and Security
Verify discovery, artifacts, Feed signatures, and execution authority before use.
The on-chain identity record, public discovery fingerprint, and solver-facing ABI provide the canonical public identity and interface material.
Current explorer and Sourcify references are maintained in the root README. The repository documents exact-match Facade verification and publishes the corresponding Standard JSON input.
Use the Facade deployment record for published constructor, transaction, block, init-code, and runtime evidence. The Standard JSON input supports source/compiler reproduction.
Runtime addresses and hashes can change with a future public deployment, so this Wiki links to the current contract table rather than copying them.
Every Feed must be verified against the published signer identity before route selection. The authenticated object and signature semantics are documented in the root README, implemented in feed-verification.mjs, and pinned by the SDK vectors.
Do not substitute filtered route views, cached analytics, or indexer projections for the signed payload.
The public package includes SHA-256 checksums. Additional public evidence includes:
The repository documents reproducible verification commands in its release verification section.
| Surface | Documented role |
|---|---|
| Registry / Router | Protocol identity and public on-chain state |
| Verified Signed Feed | Authority for current live route terms |
| Execution Permit | Final execution authority |
| Graph / Substreams / analytics | Passive, non-authoritative projections |
Keep signing in the integrating wallet or bot. Never commit private keys, credentials, seed phrases, or private RPC URLs.
Report suspected vulnerabilities according to the repository's security policy, not through a public disclosure containing sensitive details.