Displaying the badge

The idea

A seal follows bytecode. So a page that shows a token can hash the token's code, ask the registry, and show the answer, without registering, without an API key, and without the developer having done anything on your site.

The lookup

import { createPublicClient, http, keccak256, type Address } from "viem";

const RPC = "https://rpc.mainnet.chain.robinhood.com";
const WORKER = "https://<worker>";          // published on zkcheck.dev

export async function sealOf(address: Address) {
  const client = createPublicClient({ transport: http(RPC) });
  const code = await client.getCode({ address });
  if (!code || code === "0x") return null;
  const r = await fetch(`${WORKER}/seals/${keccak256(code)}`, { next: { revalidate: 60 } });
  return r.ok ? await r.json() : null;
}

What to show

The honest badge shows three things and links to the seal.

• The count: 8/8, 7/8. Colour it by whether it is full, and never round a 7 up.
• The word: signed or proven, from proven. Do not write "audited".
• The link: https://zkcheck.dev/seals/<hash>, where the evidence and the review live.

function Badge({ seal }: { seal: Seal | null }) {
  if (!seal) return <span className="badge muted">no seal</span>;
  const full = seal.passed === seal.checks.length;
  return (
    <a href={`https://zkcheck.dev/seals/${seal.hash}`} className={full ? "badge blue" : "badge ink"}>
      zkCheck {seal.passed}/{seal.checks.length} · {seal.proven}
    </a>
  );
}

What not to show

• A green tick alone. A seal is eight answers, not one. Show the count.
• "Audited by zkCheck." It is a review, and the review is an opinion. "Sealed" and the count is the accurate word.
• The seal's name. It is what the submitter typed. Show the token's own name.

Caching

Seals change only when a new review is written at the same hash, or when a claim marks one failed. A minute of cache is fine. The worker sends cache-control: no-store on its own responses so that your cache is the one that decides.

When the registry is on chain

The lookup becomes a view call: registry.sealOf(codehash), callable from a contract too, so a launchpad can require passed == 8 before listing. The HTTP endpoint stays as a mirror. Nothing about the badge changes except where it reads from.

Verifying before you display

If you display a badge, you are vouching for the lookup. Once per seal, verify the signature against the auditor's published address; Verify a seal yourself is twenty lines and can run in your build.