Docs · Developers

Reading a seal

The public API: list seals, fetch one by code hash, and what each field means.

Seals are read from the worker over HTTPS. There is no key and no rate limit worth mentioning; the responses are small and cache for thirty seconds.

Status. Until the on-chain registry exists, the worker's database is the registry. The base URL is published on the site once the worker is deployed; the site itself reads from it. The shapes below are final.

Endpoints

Method	Path	Returns
`GET`	`/seals`	Every seal, newest first.
`GET`	`/seals/<hash>`	One seal, or `404 {"error":"no seal"}`. The hash is `0x` plus 64 lower-case hex characters.
`GET`	`/jobs/<id>`	The status of a review in progress.
`GET`	`/`	`{ ok, auditor, seals }`: the auditor's address and the count.

A seal

{
  "hash": "0xb857b3aa…",
  "name": "Remus factory",
  "symbol": "REMUS",
  "address": "0x59eb9157A24bF41F3758eF85a8F62e03c19b3E66",
  "commit": "3f1c9a2e…",
  "contract": "DuoFactoryPons",
  "compiler": "0.8.26+commit.8a97fa7a",
  "checks": [
    { "id": "01", "title": "No hidden mint", "pass": true, "note": "Nothing in the code creates supply." },
    { "id": "07", "title": "Sell path clears", "pass": null, "note": "Not run: no wallet holds this token yet." }
  ],
  "passed": 7,
  "review": "The contract is a factory that …\n\nBottom line: …",
  "reviewModel": "claude-opus-5",
  "auditor": "0x7099…79C8",
  "signature": "0xce18…7d61c",
  "proven": "signed",
  "x": "1837…",
  "createdAt": 1789852243690
}

Field	Notes
`hash`	The key. `keccak256(eth_getCode(address))`, lower-case.
`address`	Null when the review was of undeployed bytecode.
`commit`	The git commit the source was read at. The repository is not returned.
`checks[].pass`	`true`, `false`, or `null` for not run.
`checks[].note`	One sentence of evidence. Always present.
`passed`	Count of `true`.
`review`	Null when skipped; `reviewModel` then starts with `skipped:` and says why.
`proven`	`signed` or `zkvm`.
`x`	The post id, or null.

A job

{ "id": "af7187f7efd52810", "status": "running", "step": "Compiling with Foundry", "error": null, "hash": null }

status is queued, running, done or failed. On done, hash is set and the seal exists. On failed, error is one sentence.

Looking up a contract you did not seal

Hash its code and ask:

import { createPublicClient, http, keccak256 } from "viem";

const client = createPublicClient({ transport: http("https://rpc.mainnet.chain.robinhood.com") });
const code = await client.getCode({ address });
const hash = keccak256(code!);
const seal = await fetch(`${WORKER}/seals/${hash}`).then((r) => (r.ok ? r.json() : null));

A null means no seal for that code. Any deployment of the same bytecode anywhere returns the same seal.

Verifying the signature

Do not trust the endpoint; check the auditor signed what it says. Verify a seal yourself is the full recipe: rebuild the digest from the public fields and recover the signer.

Names

name and symbol are what the submitter typed. Read the token's own name() and symbol() if you need them to be true.

Passing the checks

Displaying the badge