Glossary

Seal. The record zkCheck writes for one code hash: eight answers, a review, an auditor and a signature. It follows the bytecode, not the address.

zk review. The whole pipeline that produces a seal, from the GitHub grant to the signature. Named for where it is going, a zkVM, and honest about where it is, signed checks.

Code hash. keccak256 of a contract's runtime bytecode, the code that sits at the address after deployment, not the creation code that deploys it. Anyone can recompute it with eth_getCode.

Runtime bytecode. What eth_getCode returns. Distinct from creation bytecode, which includes the constructor and is gone after deployment.

Metadata. The CBOR block the Solidity compiler appends to runtime bytecode, holding a hash of the source and the compiler version. It changes with the source path, so zkCheck sets it aside when matching.

Immutables. Contract variables set once in the constructor and inlined into the runtime code. The compiled artifact has zeros where they go; the chain has the values. zkCheck blanks both before matching.

The eight checks. Rule set one. Eight yes-or-no questions answered on the compiled contract: hidden mint, owner drain, tax cap, blacklist, pause, upgradeability, sell path, self-destruct.

Rule set. A numbered, frozen list of checks. A seal records which rule set it was made under. Rule set two adds checks; it never changes the meaning of rule set one.

Evidence. The one sentence attached to each answer, naming the function and the path through which the check decided. A fail always has one.

Review. The auditor's signed description of what the code does. An opinion, labelled as one, separate from the checks, and never quoting the source.

Auditor. A key that signs seals and has a stake locked behind them. Today there is one, run by zkCheck. The design accepts any key that stakes.

Stake. The tokens an auditor locks behind a seal. A passed claim takes them.

Claim. A challenge against a seal, opened with the transaction that exploited a sealed contract through something a check covered. Decided by a vote of stakers who are not the auditor in question.

Cover pool. A share of every fee, held with the stakes, paid out to holders of a sealed contract that fails a claim.

Proven. A seal whose checks ran inside a zkVM and carry a verifiable receipt. Distinct from signed, where the auditor's key vouches for the answers. Every seal says which it is.

zkVM. A virtual machine that executes ordinary code and produces a succinct proof that it ran and produced a given output. The proof can be verified by anyone, including a smart contract, without re-running the code.

Registry. The on-chain contract that will hold seals, auditors, stakes and claims. Not deployed yet; until it is, the worker's database is the registry and the site says so.

Press. The worker that runs the zk review. Named for what it does: the code goes in, only the seal comes out.